Trojaner-Board - ads by cinema-plus 1.7c und weitere Seuchen

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - ads by cinema-plus 1.7c und weitere Seuchen (https://www.trojaner-board.de/160023-ads-by-cinema-plus-1-7c-seuchen.html)

ads by cinema-plus 1.7c und weitere Seuchen

Tachschön in die Runde, beim surfen im Internet öffnen sich hunderte von Werbefenstern der unterschiedlichsten Anbieter und zeitweise wird vollkommen ohne Zusammenhang eine Audio über Loch Ness eingespielt?! Das Laufwerk macht deutliche Geräusche. Avira hatte Adware installcore gen 7 gemeldet. Nach drei Browserwechseln habe ich jetzt im Opera Browser einen Adblocker eingesetzt; aktuell gesperrte Ads: 1026 Stück - in wenigen Minuten im www. :crazy:
Ich hatte bereits gegooglt und einige eurer Tipps ausgeführt. Es wurden immer Probleme ermittelt, aber nie abgestellt. Das Laptop ist erst drei Wochen alt - ich würde gern mit euer Hilfe das Gerät bereinigen, oder platt machen. Anbei die gewünschen Log Files: ich habe noch eigene txt. Dokumente von otl, jrt, malware, avira und adwclean - passen leider nicht alle rein, können nachgeliefert werden, wenn gewünscht. Vielen Dank im Voraus für die Unterstützung!

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Hi Schrauber, alles klar - geht los:

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 18:03 on 23/10/2014 (Mimi)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2014

Ran by Mimi at 2014-10-23 18:08:05

Running from C:\Users\Mimi\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.4.144 - Adobe Systems, Inc.)

Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)

Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)

Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 6.223.215.5 - Broadcom Corporation)

Broadcom Bluetooth Drivers (HKLM\...\{0A1B4690-E176-4533-8058-939480AEE1D0}) (Version: 12.0.0.9130 - Broadcom Corporation)

Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden

Building the Great Wall of China Collector's Edition (x32 Version: 3.0.2.48 - WildTangent) Hidden

Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.) Hidden

Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.) Hidden

Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.) Hidden

Crazy Chicken Soccer (x32 Version: 2.2.0.110 - WildTangent) Hidden

CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.6.3728 - CyberLink Corp.)

CyberLink Media Suite 10 (x32 Version: 10.0.6.3728 - CyberLink Corp.) Hidden

Cyberlink PhotoDirector (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.4.4824 - CyberLink Corp.)

Cyberlink PhotoDirector (x32 Version: 3.0.4.4824 - CyberLink Corp.) Hidden

CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.6.3821 - CyberLink Corp.)

CyberLink Power2Go 8 (x32 Version: 8.0.6.3821 - CyberLink Corp.) Hidden

CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.6.3604 - CyberLink Corp.)

CyberLink PowerDirector 10 (x32 Version: 10.0.6.3604 - CyberLink Corp.) Hidden

CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3.3709 - CyberLink Corp.)

CyberLink PowerDVD 12 (x32 Version: 12.0.3.3709 - CyberLink Corp.) Hidden

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.3.3907 - CyberLink Corp.)

CyberLink YouCam (x32 Version: 5.0.3.3907 - CyberLink Corp.) Hidden

DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden

Energy Star (HKLM\...\{465CA2B6-98AF-4E77-BE22-A908C34BB9EC}) (Version: 1.0.9 - Hewlett-Packard Company)

Evernote v. 5.2 (HKLM-x32\...\{412F6426-A3C7-11E3-8A71-00163E98E7D6}) (Version: 5.2.0.2951 - Evernote Corp.)

Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden

Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

HP 3D DriveGuard (HKLM-x32\...\{F90A86C9-7779-47DD-AC06-8EE832C55F55}) (Version: 6.0.18.1 - Hewlett-Packard Company)

HP CoolSense (HKLM-x32\...\{E2C8D0C2-1C97-4C05-939A-5B13A0FE655C}) (Version: 2.20.31 - Hewlett-Packard Company)

HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden

HP Documentation (HKLM-x32\...\{082B1425-0F24-43FA-9B64-E8F617B0AD3B}) (Version: 1.1.0.0 - Hewlett-Packard)

HP Postscript Converter (Version: 4.5.12202 - Hewlett-Packard) Hidden

HP Recovery Manager (x32 Version: 1.16.1420 - Hewlett-Packard) Hidden

HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7493.4758 - Hewlett-Packard)

HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.11 - Hewlett-Packard)

HP SimplePass (Version: 8.01.11 - Hewlett-Packard) Hidden

HP Support Assistant (HKLM-x32\...\{8C696B4B-6AB1-44BC-9416-96EAC474CABE}) (Version: 7.5.2.12 - Hewlett-Packard Company)

HP System Event Utility (HKLM-x32\...\{DEF23826-DB71-4654-BC00-D5D6C20802EA}) (Version: 1.1.4 - Hewlett-Packard Company)

HP Utility Center (HKLM\...\{36F80C5F-DC0D-4DF4-AF09-DC1867F0EB0A}) (Version: 2.4.4 - Hewlett-Packard Company)

HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)

Inst5675 (Version: 8.01.11 - Softex Inc.) Hidden

Inst5676 (Version: 8.01.11 - Softex Inc.) Hidden

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3408 - Intel Corporation)

Intel(R) Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.0.0.1002 - Intel Corporation)

Intel(R) Smart Connect Technology (HKLM\...\{8B4EA042-9E21-46FB-8286-225F4D51CC52}) (Version: 4.2.41.2710 - Intel Corporation)

Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)

Intel(R) Trusted Execution Engine (Version: 1.1.1.1 - Intel Corporation) Hidden

Intel(R) Trusted Execution Engine Driver (Version: 1.0.0.1064 - Intel Corporation) Hidden

iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)

Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)

Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Opera Stable 25.0.1614.50 (HKLM-x32\...\Opera 25.0.1614.50) (Version: 25.0.1614.50 - Opera Software ASA)

Plants vs. Zombies - Game of the Year (x32 Version: 3.0.2.51 - WildTangent) Hidden

Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden

Ranch Rush 2 - Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.273.40 - Realtek Semiconductor Corp.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.24.1218.2013 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7231 - Realtek Semiconductor Corp.)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 18.1.5.2 - Synaptics Incorporated)

TeamViewer 9 Host (HKLM-x32\...\TeamViewer 9 Host) (Version: 9.0.32494 - TeamViewer)

Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden

Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden

Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden

Virtual Families (x32 Version: 2.2.0.98 - WildTangent) Hidden

Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden

WildTangent Games App für HP (x32 Version: 4.0.11.2 - WildTangent) Hidden

WildTangent-Spiele (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)

Youda Jewel Shop (x32 Version: 3.0.2.51 - WildTangent) Hidden
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

21-10-2014 00:14:05 Installed SpyHunter
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {03525191-2818-4456-888D-3A7192E2BACE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask

Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {17C72762-734C-4B70-AAC2-5D74CC2519EB} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe

Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {21199D4C-F9E7-4A63-8AFD-C469861365D8} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics

Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate

Task: {324B0345-C24C-413A-8166-A55DA379CEB2} - System32\Tasks\Opera scheduled Autoupdate 1412885971 => C:\Program Files (x86)\Opera\launcher.exe [2014-10-15] (Opera Software)

Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)

Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)

Task: {435A3907-8132-40E2-8BA5-142799C77218} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe

Task: {4757E115-2C2F-4AE2-BB63-860AD2712FC3} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv

Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance

Task: {537E8FD2-D489-4A80-B2AB-0050A0FBD196} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [2014-03-07] (CyberLink Corp.)

Task: {56BD98E5-BC44-41BC-81FE-3287F5B2237E} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload

Task: {57775F9D-AFB7-489B-B1FD-3FF1E8656E51} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [2013-11-01] (Hewlett-Packard Development Company, L.P.)

Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup

Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task

Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task

Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask

Task: {98292BAF-42C3-4FC1-9056-7EB1EE3B3C57} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation

Task: {9BF7FFD1-1970-4AB6-8C7C-3D1704385292} - System32\Tasks\DTTZBVQB => C:\Users\Stephan\AppData\Roaming\DTTZBVQB.exe <==== ATTENTION

Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work

Task: {A3C40E8E-4E02-4ECF-87EB-E8940B97A994} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-10-15] (Microsoft Corporation)

Task: {A7D760E0-5FF2-4493-BE8A-D04147F5137C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)

Task: {C111F0E1-07DD-446E-B7CC-1FED8676AAF5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-12-18] (Hewlett-Packard)

Task: {CBDA51B5-18F3-4C3F-BBAD-09E7E42FDD0E} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-03-18] (Microsoft Corporation)

Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask

Task: {D352DA66-6B83-46D8-9915-8E7B856C5978} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management

Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization

Task: {E320C1A2-C49D-4B28-8CE2-B591B1D3CC3F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company)

Task: {E611AC48-C78A-49B8-BD92-2BBFD6609FCA} - System32\Tasks\BHWWS => C:\Users\Stephan\AppData\Roaming\BHWWS.exe <==== ATTENTION

Task: {E6BC8682-1BE0-47F6-8A8B-AB9F8FEC3788} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe

Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE

Task: {F0B98C9F-6959-4722-99E9-087B230FC7AF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-12-18] (Hewlett-Packard)

Task: C:\Windows\Tasks\BHWWS.job => C:\Users\Stephan\AppData\Roaming\BHWWS.exe <==== ATTENTION

Task: C:\Windows\Tasks\DTTZBVQB.job => C:\Users\Stephan\AppData\Roaming\DTTZBVQB.exe <==== ATTENTION
 

==================== Loaded Modules (whitelisted) =============
 

2014-03-28 13:31 - 2014-03-28 13:31 - 02110464 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll

2014-03-28 13:27 - 2014-03-28 13:27 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll

2014-03-28 13:27 - 2014-03-28 13:27 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll

2014-03-28 13:27 - 2014-03-28 13:27 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll

2014-03-28 13:48 - 2014-03-28 13:48 - 00367504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll

2014-03-28 13:48 - 2014-03-28 13:48 - 00712080 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll

2013-12-04 08:44 - 2013-12-04 08:44 - 00200168 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe

2013-12-04 08:44 - 2013-12-04 08:44 - 00054760 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll

2013-12-04 08:44 - 2013-12-04 08:44 - 00034792 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTNetMon.dll

2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2014-03-28 13:36 - 2014-03-28 13:36 - 00065024 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

2014-07-31 12:16 - 2014-07-31 12:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-07-31 12:16 - 2014-07-31 12:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2014-10-21 20:25 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2014-10-21 20:25 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2014-10-21 20:25 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

2014-10-21 20:25 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll

2014-10-21 20:25 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-2446055026-3567564273-3713566540-500 - Administrator - Disabled)

Gast (S-1-5-21-2446055026-3567564273-3713566540-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2446055026-3567564273-3713566540-1003 - Limited - Enabled)

Mimi (S-1-5-21-2446055026-3567564273-3713566540-1004 - Administrator - Enabled) => C:\Users\Mimi

Stephan (S-1-5-21-2446055026-3567564273-3713566540-1001 - Administrator - Enabled) => C:\Users\Stephan
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (10/21/2014 10:42:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 174375
 

Error: (10/21/2014 10:42:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 174375
 

Error: (10/21/2014 10:42:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (10/21/2014 10:09:35 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)

Description: There was an error with the Windows Location Provider database
 

Error: (10/21/2014 08:02:45 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)

Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (10/21/2014 07:47:49 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)

Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (10/21/2014 07:47:27 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)

Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (10/21/2014 07:34:28 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)

Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (10/21/2014 07:34:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)

Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 
 

System errors:

=============

Error: (10/21/2014 10:42:58 PM) (Source: ACPI) (EventID: 13) (User: )

Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 

Error: (10/21/2014 08:53:23 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\Windows\System32\bcmihvsrv64.dll
 

Error: (10/21/2014 07:34:40 PM) (Source: DCOM) (EventID: 10010) (User: Steppo)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}
 

Error: (10/21/2014 07:34:10 PM) (Source: DCOM) (EventID: 10010) (User: Steppo)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}
 

Error: (10/21/2014 07:33:40 PM) (Source: DCOM) (EventID: 10010) (User: Steppo)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}
 

Error: (10/21/2014 07:33:10 PM) (Source: DCOM) (EventID: 10010) (User: Steppo)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}
 
 

Microsoft Office Sessions:

=========================

Error: (10/21/2014 10:42:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 174375
 

Error: (10/21/2014 10:42:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 174375
 

Error: (10/21/2014 10:42:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (10/21/2014 10:09:35 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)

Description: -2147024883
 

Error: (10/21/2014 08:02:45 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)

Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151
 

Error: (10/21/2014 07:47:49 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)

Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151
 

Error: (10/21/2014 07:47:27 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)

Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151
 

Error: (10/21/2014 07:34:28 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)

Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151
 

Error: (10/21/2014 07:34:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)

Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Pentium(R) CPU N3530 @ 2.16GHz

Percentage of memory in use: 39%

Total physical RAM: 3988.09 MB

Available physical RAM: 2394.09 MB

Total Pagefile: 4692.09 MB

Available Pagefile: 2564.12 MB

Total Virtual: 131072 MB

Available Virtual: 131071.79 MB
 

==================== Drives ================================
 

Drive c: (Windows) (Fixed) (Total:678.02 GB) (Free:576.07 GB) NTFS

Drive d: (RECOVERY) (Fixed) (Total:19.6 GB) (Free:1.91 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 698.6 GB) (Disk ID: 9AF1B1A5)
 

Partition: GPT Partition Type.
 

==================== End Of Log ============================

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014

Ran by Mimi (administrator) on STEPPO on 23-10-2014 18:05:46

Running from C:\Users\Mimi\Desktop

Loaded Profiles: Mimi &  (Available profiles: Stephan & Mimi)

Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe

() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7573208 2014-04-22] (Realtek Semiconductor)

HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe [3962936 2014-03-28] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [415288 2014-03-28] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [415288 2014-03-28] (Hewlett-Packard)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2811120 2014-03-13] (Synaptics Incorporated)

HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [126240 2014-02-13] (Hewlett-Packard Company)

HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [475448 2014-03-26] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-09-24] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-2446055026-3567564273-3713566540-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Pokki] => C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform

BootExecute: autocheck autochk * sdnclean64.exe
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPNOT14/4

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

SearchScopes: HKLM - {FE81BB90-6408-42D2-8133-29E869E8DC35} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{EFBDAE16-3547-4A0A-96FA-C59753428745}: [NameServer] 5.79.84.141,8.38.77.107
 

FireFox:

========

FF ProfilePath: C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default

FF Homepage: google.de

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()

FF Extension: No Name - C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\Extensions\cliqz@cliqz.com [2014-10-21]

FF Extension: No Name - C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\extensions\3c8f3083-413b-4aa6-ad29-fb93d8982e80@gmail.com [Not Found]

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
 

Chrome: 

=======
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-09-24] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-09-24] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)

S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2251992 2013-11-13] (Broadcom Corporation.)

R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-01-28] (WildTangent)

R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2014-01-13] (Hewlett-Packard Company) [File not signed]

R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [469304 2014-03-26] (Hewlett-Packard Development Company, L.P.)

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)

R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [200168 2013-12-04] ()

R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)

S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2003-04-18] () [File not signed]

S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)

S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-05-07] (Microsoft Corporation)

R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [88064 2014-03-28] (Softex Inc.) [File not signed]

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-01-09] (Realtek Semiconductor)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)

S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)

R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [190704 2014-03-13] (Synaptics Incorporated)

S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-04-02] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-09-24] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-09-24] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-09-24] (Avira Operations GmbH & Co. KG)

R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-11-13] (Broadcom Corporation.)

R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7517872 2014-06-12] (Broadcom Corporation)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)

S3 BtwSerialBus; C:\Windows\System32\drivers\BtwSerialBus.sys [150744 2013-09-09] (Broadcom Corporation.)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91912 2013-11-12] (CyberLink)

R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [21408 2013-08-13] ()

R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [21920 2013-08-13] ()

R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [29088 2013-08-13] ()

R3 ISCT; C:\Windows\System32\drivers\ISCTD64.sys [46568 2013-08-13] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-23] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)

R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-11] (Intel Corporation)

R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [291544 2014-01-04] (Realtek Semiconductor Corp.)

U5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [466136 2014-01-15] (Realsil Semiconductor Corporation)

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2014-03-13] (Synaptics Incorporated)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-03-13] (Synaptics Incorporated)

R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-23 18:05 - 2014-10-23 18:05 - 00016813 _____ () C:\Users\Mimi\Desktop\FRST.txt

2014-10-23 18:05 - 2014-10-23 18:05 - 00000000 ____D () C:\FRST

2014-10-23 18:02 - 2014-10-23 18:03 - 00000470 _____ () C:\Users\Mimi\Desktop\defogger_disable.log

2014-10-23 18:02 - 2014-10-23 18:02 - 00000000 _____ () C:\Users\Mimi\defogger_reenable

2014-10-23 17:59 - 2014-10-23 17:54 - 02112000 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe

2014-10-23 17:58 - 2014-10-23 17:56 - 00380416 _____ () C:\Users\Mimi\Desktop\Gmer-19357.exe

2014-10-23 17:58 - 2014-10-23 17:52 - 00050477 _____ () C:\Users\Mimi\Desktop\Defogger.exe

2014-10-23 17:31 - 2014-10-23 17:31 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\70474D78.sys

2014-10-21 23:53 - 2014-10-21 23:53 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Avira

2014-10-21 23:03 - 2013-08-22 15:25 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141021-230357.backup

2014-10-21 20:26 - 2014-10-21 20:26 - 00001414 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-10-21 20:26 - 2014-10-21 20:26 - 00001402 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-10-21 20:26 - 2014-10-21 20:26 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-10-21 20:26 - 2014-10-21 20:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-10-21 20:25 - 2014-10-21 22:46 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-10-21 20:25 - 2014-10-21 20:41 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-10-21 20:25 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2014-10-21 19:29 - 2014-10-21 19:31 - 01962496 _____ () C:\Users\Mimi\Desktop\adwcleaner_4.001.exe

2014-10-21 17:09 - 2014-10-21 17:09 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Avira

2014-10-21 17:06 - 2014-10-21 17:05 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-10-21 17:03 - 2014-09-24 12:44 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-10-21 17:03 - 2014-09-24 12:44 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-10-21 17:03 - 2014-09-24 12:44 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2014-10-21 16:44 - 2014-09-22 08:42 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-10-21 16:22 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll

2014-10-21 16:22 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll

2014-10-21 02:17 - 2014-10-21 02:17 - 00000000 _____ () C:\autoexec.bat

2014-10-21 02:13 - 2014-10-21 07:49 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP

2014-10-21 01:53 - 2014-10-21 01:53 - 00000000 ____D () C:\Synaptics

2014-10-21 01:22 - 2014-10-23 17:31 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-21 01:22 - 2014-10-21 01:23 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-21 01:22 - 2014-10-21 01:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-21 01:21 - 2014-10-21 01:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-21 01:21 - 2014-10-21 01:21 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-10-21 01:21 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-10-21 01:21 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-10-21 01:21 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-10-21 01:02 - 2014-10-21 01:07 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-10-20 23:29 - 2014-10-20 23:29 - 00602112 _____ (OldTimer Tools) C:\Users\Mimi\Desktop\OTL.exe

2014-10-20 23:22 - 2014-10-20 23:22 - 00000000 ____D () C:\Windows\ERUNT

2014-10-20 23:20 - 2014-10-20 23:21 - 01705698 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT.exe

2014-10-20 23:04 - 2014-10-21 23:24 - 00000000 ____D () C:\AdwCleaner

2014-10-16 21:10 - 2014-10-20 22:34 - 00002166 _____ () C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk

2014-10-16 21:10 - 2014-10-16 21:10 - 00002337 _____ () C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk

2014-10-16 13:26 - 2014-10-16 13:26 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Opera Software

2014-10-16 13:26 - 2014-10-16 13:26 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Opera Software

2014-10-15 06:31 - 2014-09-28 00:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-15 06:31 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll

2014-10-15 06:31 - 2014-09-04 01:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll

2014-10-15 06:31 - 2014-09-04 01:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll

2014-10-15 06:30 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-10-15 06:30 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-10-15 06:29 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-10-15 06:29 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-10-15 06:29 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-10-15 06:29 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-10-15 06:29 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-10-15 06:29 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-10-15 06:29 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-10-15 06:29 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-10-15 06:29 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-10-15 06:29 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-10-15 06:29 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-10-15 06:29 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-10-15 06:29 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-10-15 06:29 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-10-15 06:29 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-10-15 06:29 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-10-15 06:29 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-10-15 06:29 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-10-15 06:29 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-10-15 06:29 - 2014-09-19 02:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-10-15 06:29 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-10-15 06:29 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-10-15 06:29 - 2014-09-19 02:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-10-15 06:29 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-10-15 06:29 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-10-15 06:29 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-10-15 06:29 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-10-15 06:29 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-10-15 06:28 - 2014-09-13 08:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-10-15 06:28 - 2014-09-13 07:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-10-15 06:28 - 2014-09-08 05:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-10-15 06:28 - 2014-09-08 03:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-10-15 06:28 - 2014-09-08 03:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-10-15 06:28 - 2014-09-08 02:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-10-15 06:28 - 2014-09-08 02:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-10-15 06:28 - 2014-09-08 02:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-10-15 06:28 - 2014-09-08 02:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2014-10-15 06:28 - 2014-09-08 02:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-10-15 06:28 - 2014-09-08 02:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-10-15 06:28 - 2014-09-08 02:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-10-15 06:28 - 2014-09-08 01:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-10-15 06:28 - 2014-09-08 01:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-10-15 06:28 - 2014-09-08 01:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-10-15 06:28 - 2014-09-08 01:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-10-15 06:27 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll

2014-10-15 06:27 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll

2014-10-15 06:27 - 2014-08-16 06:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-10-15 06:27 - 2014-08-16 06:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll

2014-10-15 06:27 - 2014-08-16 06:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2014-10-15 06:27 - 2014-08-16 05:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-10-15 06:27 - 2014-08-16 05:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-10-15 06:27 - 2014-08-16 05:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-10-15 06:27 - 2014-08-16 05:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-10-15 06:27 - 2014-08-16 05:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll

2014-10-15 06:27 - 2014-08-16 05:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2014-10-15 06:27 - 2014-08-16 03:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-10-15 06:27 - 2014-08-16 03:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll

2014-10-15 06:27 - 2014-08-16 02:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll

2014-10-15 06:27 - 2014-08-16 02:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll

2014-10-15 06:27 - 2014-08-16 02:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll

2014-10-15 06:27 - 2014-08-16 02:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll

2014-10-15 06:27 - 2014-08-16 02:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll

2014-10-15 06:27 - 2014-08-16 02:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll

2014-10-15 06:27 - 2014-08-16 02:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll

2014-10-15 06:27 - 2014-08-16 02:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll

2014-10-15 06:27 - 2014-08-16 02:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-15 06:27 - 2014-08-16 02:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll

2014-10-15 06:27 - 2014-08-16 02:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll

2014-10-15 06:27 - 2014-08-16 02:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll

2014-10-15 06:27 - 2014-08-16 02:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-15 06:27 - 2014-08-16 02:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll

2014-10-15 06:27 - 2014-08-16 02:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll

2014-10-15 06:27 - 2014-08-16 02:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll

2014-10-15 06:27 - 2014-08-16 02:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-15 06:27 - 2014-08-16 02:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll

2014-10-15 06:27 - 2014-08-16 02:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll

2014-10-15 06:27 - 2014-08-16 02:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll

2014-10-15 06:27 - 2014-08-16 02:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe

2014-10-15 06:27 - 2014-08-16 02:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-10-15 06:27 - 2014-08-16 02:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll

2014-10-15 06:27 - 2014-08-01 01:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml

2014-10-15 06:26 - 2014-10-10 00:16 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-10-15 06:26 - 2014-10-09 00:09 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-10-15 06:26 - 2014-09-19 03:24 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-10-15 06:26 - 2014-09-13 08:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-15 06:26 - 2014-09-13 07:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-10-15 06:26 - 2014-08-29 03:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll

2014-10-15 06:26 - 2014-08-29 01:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-10-15 06:26 - 2014-08-29 01:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-10-15 06:14 - 2014-10-15 06:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-10-15 06:11 - 2014-10-23 17:31 - 00001358 _____ () C:\Windows\Tasks\BHWWS.job

2014-10-15 06:11 - 2014-10-15 06:11 - 00004364 _____ () C:\Windows\System32\Tasks\BHWWS

2014-10-15 06:10 - 2014-10-23 17:31 - 00001708 _____ () C:\Windows\Tasks\DTTZBVQB.job

2014-10-15 06:10 - 2014-10-15 06:10 - 00004714 _____ () C:\Windows\System32\Tasks\DTTZBVQB

2014-10-09 22:19 - 2014-10-16 13:26 - 00003842 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1412885971

2014-10-09 22:19 - 2014-10-16 13:26 - 00001158 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2014-10-09 22:19 - 2014-10-16 13:26 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-10-09 22:19 - 2014-10-09 22:19 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Opera Software

2014-10-09 22:19 - 2014-10-09 22:19 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Opera Software

2014-10-07 00:55 - 2014-10-07 00:55 - 00000000 ____D () C:\Users\Stephan\Documents\Avatar

2014-10-07 00:54 - 2014-10-07 00:54 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\CyberLink

2014-10-07 00:52 - 2014-10-07 00:52 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Apple Computer

2014-10-06 23:33 - 2014-10-21 17:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-10-06 23:32 - 2014-10-21 17:03 - 00000000 ____D () C:\ProgramData\Avira

2014-10-06 23:32 - 2014-10-21 17:03 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-10-06 16:59 - 2014-10-06 16:59 - 00000000 ____D () C:\Users\Mimi\Documents\web

2014-10-06 14:45 - 2014-10-06 14:45 - 00002522 _____ () C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

2014-10-06 05:58 - 2014-10-06 05:58 - 00000000 ____D () C:\Users\Mimi\AppData\Local\CrashDumps

2014-10-01 05:28 - 2014-10-15 06:39 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Apple Computer

2014-09-30 22:46 - 2014-09-30 22:55 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Apple Computer

2014-09-30 22:46 - 2014-09-30 22:46 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Apple Computer

2014-09-30 22:46 - 2014-09-30 22:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-09-30 22:44 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys

2014-09-30 22:43 - 2014-09-30 22:44 - 00000000 ____D () C:\Program Files\iTunes

2014-09-30 22:43 - 2014-09-30 22:44 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-09-30 22:43 - 2014-09-30 22:43 - 00000000 ____D () C:\ProgramData\Apple Computer

2014-09-30 22:43 - 2014-09-30 22:43 - 00000000 ____D () C:\Program Files\iPod

2014-09-30 22:41 - 2014-09-30 22:41 - 00002535 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

2014-09-30 22:41 - 2014-09-30 22:41 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Apple

2014-09-30 22:41 - 2014-09-30 22:41 - 00000000 ____D () C:\Program Files\Common Files\Apple

2014-09-30 22:41 - 2014-09-30 22:41 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update

2014-09-28 11:14 - 2014-10-02 07:03 - 00000000 ____D () C:\Users\Stephan\Desktop\Flohmarkt1

2014-09-26 11:35 - 2014-09-26 11:36 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Mozilla

2014-09-26 11:35 - 2014-09-26 11:36 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Mozilla

2014-09-25 22:39 - 2014-09-25 22:39 - 00003130 _____ () C:\Windows\System32\Tasks\{00B59D34-BE6F-4EDF-8D3B-A9BBBA3CCEB6}

2014-09-24 20:18 - 2014-09-24 20:18 - 00000000 ____D () C:\Users\Stephan\AppData\Local\com

2014-09-24 20:10 - 2014-10-16 13:20 - 00000000 ___HD () C:\Users\Public\Temp

2014-09-24 06:41 - 2014-09-26 06:53 - 00000000 ____D () C:\Users\Stephan\AppData\Local\CrashDumps

2014-09-23 22:42 - 2014-10-23 17:34 - 00000000 ____D () C:\Users\Mimi\Documents\Outlook-Dateien

2014-09-23 22:31 - 2014-09-23 22:31 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\WildTangent

2014-09-23 22:22 - 2014-09-23 22:22 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Mozilla

2014-09-23 22:22 - 2014-09-23 22:22 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Mozilla

2014-09-23 22:22 - 2014-09-23 22:22 - 00000000 ____D () C:\ProgramData\Mozilla

2014-09-23 22:21 - 2014-10-16 18:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-09-23 09:27 - 2014-07-24 11:44 - 16874496 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll

2014-09-23 09:26 - 2014-07-24 17:28 - 00468288 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS

2014-09-23 09:26 - 2014-07-24 17:28 - 00412992 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys

2014-09-23 09:26 - 2014-07-24 17:28 - 00143680 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-09-23 09:26 - 2014-07-24 17:23 - 01519488 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll

2014-09-23 09:26 - 2014-07-24 17:20 - 00645592 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll

2014-09-23 09:26 - 2014-07-24 17:16 - 02574208 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2014-09-23 09:26 - 2014-07-24 17:07 - 07424320 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-09-23 09:26 - 2014-07-24 17:07 - 02009920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

2014-09-23 09:26 - 2014-07-24 17:05 - 01660048 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2014-09-23 09:26 - 2014-07-24 17:05 - 01519560 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe

2014-09-23 09:26 - 2014-07-24 17:05 - 01488008 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2014-09-23 09:26 - 2014-07-24 17:05 - 01356840 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe

2014-09-23 09:26 - 2014-07-24 17:03 - 02141920 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll

2014-09-23 09:26 - 2014-07-24 17:03 - 00882136 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll

2014-09-23 09:26 - 2014-07-24 17:03 - 00818624 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll

2014-09-23 09:26 - 2014-07-24 17:03 - 00360480 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll

2014-09-23 09:26 - 2014-07-24 17:03 - 00205512 _____ (Microsoft Corporation) C:\Windows\system32\mftranscode.dll

2014-09-23 09:26 - 2014-07-24 16:57 - 00475968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-09-23 09:26 - 2014-07-24 15:48 - 02410976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2014-09-23 09:26 - 2014-07-24 15:46 - 00477200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll

2014-09-23 09:26 - 2014-07-24 15:36 - 02145472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll

2014-09-23 09:26 - 2014-07-24 15:36 - 00707536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll

2014-09-23 09:26 - 2014-07-24 15:36 - 00674512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll

2014-09-23 09:26 - 2014-07-24 15:36 - 00355800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfreadwrite.dll

2014-09-23 09:26 - 2014-07-24 15:36 - 00180720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mftranscode.dll

2014-09-23 09:26 - 2014-07-24 13:44 - 00674816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys

2014-09-23 09:26 - 2014-07-24 13:43 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys

2014-09-23 09:26 - 2014-07-24 13:42 - 01200640 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys

2014-09-23 09:26 - 2014-07-24 13:42 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nwifi.sys

2014-09-23 09:26 - 2014-07-24 13:05 - 00287232 _____ (Microsoft Corporation) C:\Windows\system32\usbmon.dll

2014-09-23 09:26 - 2014-07-24 12:20 - 02050560 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll

2014-09-23 09:26 - 2014-07-24 12:06 - 00438272 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll

2014-09-23 09:26 - 2014-07-24 11:52 - 00621056 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.dll

2014-09-23 09:26 - 2014-07-24 11:39 - 00770048 _____ (Microsoft Corporation) C:\Windows\system32\WorkfoldersControl.dll

2014-09-23 09:26 - 2014-07-24 11:33 - 01741824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll

2014-09-23 09:26 - 2014-07-24 11:16 - 12730880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll

2014-09-23 09:26 - 2014-07-24 11:10 - 00540672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comdlg32.dll

2014-09-23 09:26 - 2014-07-24 11:03 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll

2014-09-23 09:26 - 2014-07-24 11:02 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2014-09-23 09:26 - 2014-07-24 10:53 - 01261056 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll

2014-09-23 09:26 - 2014-07-24 10:53 - 00449536 _____ (Microsoft Corporation) C:\Windows\system32\defragsvc.dll

2014-09-23 09:26 - 2014-07-24 10:39 - 02397184 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll

2014-09-23 09:26 - 2014-07-24 10:38 - 00371200 _____ (Microsoft Corporation) C:\Windows\system32\wlanmsm.dll

2014-09-23 09:26 - 2014-07-24 10:32 - 01532416 _____ (Microsoft Corporation) C:\Windows\system32\wlansvc.dll

2014-09-23 09:26 - 2014-07-24 10:29 - 00439296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Devices.Bluetooth.dll

2014-09-23 09:26 - 2014-07-24 10:22 - 00487936 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv

2014-09-23 09:26 - 2014-07-24 10:21 - 01231872 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.dll

2014-09-23 09:26 - 2014-07-24 10:21 - 00302080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanmsm.dll

2014-09-23 09:26 - 2014-07-24 10:18 - 00795136 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe

2014-09-23 09:26 - 2014-07-24 10:10 - 01029632 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll

2014-09-23 09:26 - 2014-07-24 10:10 - 00889344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.dll

2014-09-23 09:26 - 2014-07-24 10:10 - 00371712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv

2014-09-23 09:26 - 2014-07-24 10:01 - 01992192 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll

2014-09-23 09:26 - 2014-07-24 09:50 - 01182208 _____ (Microsoft Corporation) C:\Windows\system32\printui.dll

2014-09-23 09:26 - 2014-07-24 09:44 - 01057792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\printui.dll

2014-09-23 09:26 - 2014-07-24 09:43 - 02696704 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll

2014-09-23 09:26 - 2014-07-24 09:28 - 01600000 _____ (Microsoft Corporation) C:\Windows\system32\workfolderssvc.dll

2014-09-23 09:26 - 2014-07-24 06:11 - 00513544 _____ () C:\Windows\SysWOW64\locale.nls

2014-09-23 09:26 - 2014-07-24 06:11 - 00513544 _____ () C:\Windows\system32\locale.nls

2014-09-23 09:26 - 2014-07-12 07:55 - 00268288 _____ (Microsoft Corporation) C:\Windows\system32\wisp.dll

2014-09-23 09:26 - 2014-07-12 06:13 - 01417216 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-09-23 09:26 - 2014-07-04 14:59 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ks.sys

2014-09-23 09:26 - 2014-07-04 11:30 - 00544768 _____ (Microsoft Corporation) C:\Windows\system32\AppxPackaging.dll

2014-09-23 09:26 - 2014-07-04 11:27 - 00474112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxPackaging.dll

2014-09-23 09:26 - 2014-06-27 08:22 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys

2014-09-23 09:26 - 2014-06-19 04:13 - 00310080 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys

2014-09-23 09:26 - 2014-06-14 08:03 - 02389504 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll

2014-09-23 09:26 - 2014-06-14 07:46 - 02071552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll

2014-09-23 09:26 - 2014-06-05 12:18 - 01018368 _____ (Microsoft Corporation) C:\Windows\system32\aclui.dll

2014-09-23 09:26 - 2014-06-05 11:42 - 00889856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aclui.dll

2014-09-23 09:26 - 2014-05-31 07:00 - 01463808 _____ (Microsoft Corporation) C:\Windows\system32\wsecedit.dll

2014-09-23 09:26 - 2014-05-29 08:23 - 00427008 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll

2014-09-23 09:26 - 2014-05-29 07:25 - 00313856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll

2014-09-23 09:26 - 2014-05-06 06:41 - 00486744 _____ (Microsoft Corporation) C:\Windows\system32\netcfgx.dll

2014-09-23 09:26 - 2014-05-06 02:55 - 00391000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcfgx.dll

2014-09-23 09:26 - 2014-03-25 04:27 - 00160600 _____ (Microsoft Corporation) C:\Windows\system32\winmmbase.dll

2014-09-23 09:25 - 2014-07-24 17:28 - 00419648 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-09-23 09:25 - 2014-07-24 17:28 - 00280384 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys

2014-09-23 09:25 - 2014-07-24 17:23 - 00125472 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll

2014-09-23 09:25 - 2014-07-24 17:20 - 00263400 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe

2014-09-23 09:25 - 2014-07-24 17:16 - 00211216 _____ (Microsoft Corporation) C:\Windows\system32\SndVol.exe

2014-09-23 09:25 - 2014-07-24 17:03 - 00233888 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll

2014-09-23 09:25 - 2014-07-24 15:50 - 00098048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll

2014-09-23 09:25 - 2014-07-24 15:48 - 00180208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SndVol.exe

2014-09-23 09:25 - 2014-07-24 13:51 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDRUM.DLL

2014-09-23 09:25 - 2014-07-24 13:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL

2014-09-23 09:25 - 2014-07-24 13:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL

2014-09-23 09:25 - 2014-07-24 13:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL

2014-09-23 09:25 - 2014-07-24 13:51 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL

2014-09-23 09:25 - 2014-07-24 13:46 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys

2014-09-23 09:25 - 2014-07-24 13:45 - 00076800 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys

2014-09-23 09:25 - 2014-07-24 13:42 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NdisImPlatform.sys

2014-09-23 09:25 - 2014-07-24 13:41 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bridge.sys

2014-09-23 09:25 - 2014-07-24 13:06 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\iasnap.dll

2014-09-23 09:25 - 2014-07-24 13:05 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll

2014-09-23 09:25 - 2014-07-24 12:52 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL

2014-09-23 09:25 - 2014-07-24 12:51 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRUM.DLL

2014-09-23 09:25 - 2014-07-24 12:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL

2014-09-23 09:25 - 2014-07-24 12:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL

2014-09-23 09:25 - 2014-07-24 12:51 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL

2014-09-23 09:25 - 2014-07-24 12:49 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\WorkFoldersGPExt.dll

2014-09-23 09:25 - 2014-07-24 12:33 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-09-23 09:25 - 2014-07-24 12:32 - 00207360 _____ (Microsoft Corporation) C:\Windows\system32\powercfg.cpl

2014-09-23 09:25 - 2014-07-24 12:18 - 01089024 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll

2014-09-23 09:25 - 2014-07-24 12:12 - 00878592 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenter.dll

2014-09-23 09:25 - 2014-07-24 12:10 - 01844224 _____ (Microsoft Corporation) C:\Windows\system32\Display.dll

2014-09-23 09:25 - 2014-07-24 12:10 - 00834560 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe

2014-09-23 09:25 - 2014-07-24 12:10 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll

2014-09-23 09:25 - 2014-07-24 12:10 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasnap.dll

2014-09-23 09:25 - 2014-07-24 12:09 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll

2014-09-23 09:25 - 2014-07-24 12:05 - 00187392 _____ (Microsoft Corporation) C:\Windows\system32\WorkFoldersShell.dll

2014-09-23 09:25 - 2014-07-24 11:53 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\prnntfy.dll

2014-09-23 09:25 - 2014-07-24 11:42 - 00206336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\powercfg.cpl

2014-09-23 09:25 - 2014-07-24 11:40 - 00557056 _____ (Microsoft Corporation) C:\Windows\system32\PrintDialogs.dll

2014-09-23 09:25 - 2014-07-24 11:32 - 01048064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpedit.dll

2014-09-23 09:25 - 2014-07-24 11:27 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll

2014-09-23 09:25 - 2014-07-24 11:27 - 00779264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe

2014-09-23 09:25 - 2014-07-24 11:25 - 00832512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActionCenter.dll

2014-09-23 09:25 - 2014-07-24 11:24 - 01817088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Display.dll

2014-09-23 09:25 - 2014-07-24 11:23 - 00328704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll

2014-09-23 09:25 - 2014-07-24 11:21 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\browser.dll

2014-09-23 09:25 - 2014-07-24 11:18 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\wlansvcpal.dll

2014-09-23 09:25 - 2014-07-24 11:13 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prnntfy.dll

2014-09-23 09:25 - 2014-07-24 11:12 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll

2014-09-23 09:25 - 2014-07-24 11:11 - 00356864 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2014-09-23 09:25 - 2014-07-24 11:11 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll

2014-09-23 09:25 - 2014-07-24 11:04 - 00183808 _____ (Microsoft Corp.) C:\Windows\system32\Defrag.exe

2014-09-23 09:25 - 2014-07-24 10:58 - 00105472 _____ (Microsoft Corporation) C:\Windows\system32\BluetoothApis.dll

2014-09-23 09:25 - 2014-07-24 10:49 - 01361408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll

2014-09-23 09:25 - 2014-07-24 10:49 - 01287680 _____ (Microsoft Corporation) C:\Windows\system32\mispace.dll

2014-09-23 09:25 - 2014-07-24 10:49 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\wlanapi.dll

2014-09-23 09:25 - 2014-07-24 10:48 - 00659968 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Devices.Bluetooth.dll

2014-09-23 09:25 - 2014-07-24 10:47 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll

2014-09-23 09:25 - 2014-07-24 10:43 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshbth.dll

2014-09-23 09:25 - 2014-07-24 10:30 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanapi.dll

2014-09-23 09:25 - 2014-07-24 10:28 - 00595456 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.dll

2014-09-23 09:25 - 2014-07-24 10:23 - 01404416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll

2014-09-23 09:25 - 2014-07-24 10:20 - 00187392 _____ (Microsoft Corporation) C:\Windows\system32\puiapi.dll

2014-09-23 09:25 - 2014-07-24 10:16 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\VAN.dll

2014-09-23 09:25 - 2014-07-24 10:16 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\wpdbusenum.dll

2014-09-23 09:25 - 2014-07-24 10:15 - 00721408 _____ (Microsoft Corporation) C:\Windows\system32\twinapi.dll

2014-09-23 09:25 - 2014-07-24 10:15 - 00432128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.dll

2014-09-23 09:25 - 2014-07-24 10:10 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll

2014-09-23 09:25 - 2014-07-24 10:08 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll

2014-09-23 09:25 - 2014-07-24 10:08 - 00162816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiapi.dll

2014-09-23 09:25 - 2014-07-24 10:05 - 00448000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VAN.dll

2014-09-23 09:25 - 2014-07-24 09:58 - 00432640 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll

2014-09-23 09:25 - 2014-07-24 09:58 - 00288768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll

2014-09-23 09:25 - 2014-07-24 09:54 - 01290752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll

2014-09-23 09:25 - 2014-07-24 09:49 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\DafPrintProvider.dll

2014-09-23 09:25 - 2014-07-24 09:47 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\SettingSync.dll

2014-09-23 09:25 - 2014-07-24 09:43 - 00200192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DafPrintProvider.dll

2014-09-23 09:25 - 2014-07-24 09:41 - 00459264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSync.dll

2014-09-23 09:25 - 2014-07-24 09:33 - 03360768 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2014-09-23 09:25 - 2014-07-12 06:58 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wisp.dll

2014-09-23 09:25 - 2014-07-04 12:29 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\AppxSip.dll

2014-09-23 09:25 - 2014-07-04 12:20 - 01656832 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll

2014-09-23 09:25 - 2014-07-04 12:06 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxSip.dll

2014-09-23 09:25 - 2014-07-04 12:00 - 01351168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll

2014-09-23 09:25 - 2014-06-26 02:32 - 01029632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mispace.dll

2014-09-23 09:25 - 2014-06-26 02:29 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\dab.dll

2014-09-23 09:25 - 2014-06-20 01:37 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys

2014-09-23 09:25 - 2014-06-07 14:46 - 00216368 _____ (Microsoft Corporation) C:\Windows\system32\rsaenh.dll

2014-09-23 09:25 - 2014-06-07 12:20 - 00189016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rsaenh.dll

2014-09-23 09:25 - 2014-06-05 16:00 - 01118040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys

2014-09-23 09:25 - 2014-05-31 06:18 - 01319936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsecedit.dll

2014-09-23 09:25 - 2014-05-29 07:20 - 00427520 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-09-23 09:25 - 2014-05-29 06:36 - 00344576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-09-23 09:25 - 2014-05-26 09:26 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\AppxSysprep.dll

2014-09-23 09:25 - 2014-05-10 12:12 - 00387896 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll

2014-09-23 09:25 - 2014-05-10 10:46 - 00335680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll

2014-09-23 09:25 - 2014-03-25 04:27 - 00123920 _____ (Microsoft Corporation) C:\Windows\system32\winmm.dll

2014-09-23 09:25 - 2014-03-25 03:20 - 00128568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmm.dll

2014-09-23 09:25 - 2014-03-25 03:20 - 00127544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmmbase.dll

2014-09-23 09:24 - 2014-07-24 13:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTT102.DLL

2014-09-23 09:24 - 2014-07-24 13:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL

2014-09-23 09:24 - 2014-07-24 13:47 - 00132608 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll

2014-09-23 09:24 - 2014-07-24 13:41 - 00118272 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthpan.sys

2014-09-23 09:24 - 2014-07-24 13:22 - 00308736 _____ (Microsoft Corporation) C:\Windows\system32\compstui.dll

2014-09-23 09:24 - 2014-07-24 12:52 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTT102.DLL

2014-09-23 09:24 - 2014-07-24 12:52 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL

2014-09-23 09:24 - 2014-07-24 11:14 - 00443904 _____ (Microsoft Corporation) C:\Windows\system32\wlansec.dll

2014-09-23 09:24 - 2014-07-24 11:04 - 00492032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintDialogs.dll

2014-09-23 09:24 - 2014-07-24 10:36 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BluetoothApis.dll

2014-09-23 09:24 - 2014-07-24 10:18 - 01144320 _____ (Microsoft Corporation) C:\Windows\system32\wwanmm.dll

2014-09-23 09:24 - 2014-07-24 10:13 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\SndVolSSO.dll

2014-09-23 09:24 - 2014-07-24 10:00 - 02100736 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlowUI.dll

2014-09-23 09:24 - 2014-07-12 07:23 - 00436224 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll

2014-09-23 09:24 - 2014-07-12 06:33 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll

2014-09-23 03:34 - 2014-09-23 03:34 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-23 18:02 - 2014-09-19 12:02 - 00000000 ____D () C:\Users\Mimi

2014-10-23 18:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru

2014-10-23 17:44 - 2014-09-19 12:03 - 00000000 ____D () C:\Users\Mimi\Documents\Youcam

2014-10-23 17:41 - 2014-09-19 12:17 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{EBD4C036-B3CB-4392-808C-89DA60C8B663}

2014-10-23 17:36 - 2014-09-19 12:11 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2446055026-3567564273-3713566540-1004

2014-10-23 17:31 - 2014-09-19 11:33 - 01870555 _____ () C:\Windows\WindowsUpdate.log

2014-10-22 00:00 - 2014-09-19 11:41 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2446055026-3567564273-3713566540-1001

2014-10-21 23:59 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness

2014-10-21 23:28 - 2013-08-22 16:46 - 00032050 _____ () C:\Windows\setupact.log

2014-10-21 23:28 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-21 23:18 - 2014-03-18 11:44 - 00409730 _____ () C:\Windows\PFRO.log

2014-10-21 23:18 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI

2014-10-21 22:59 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp

2014-10-21 16:55 - 2013-08-22 17:36 - 00000000 ___HD () C:\Windows\ELAMBKUP

2014-10-21 16:54 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM

2014-10-21 16:20 - 2014-05-07 19:54 - 00800954 _____ () C:\Windows\system32\perfh007.dat

2014-10-21 16:20 - 2014-05-07 19:54 - 00174458 _____ () C:\Windows\system32\perfc007.dat

2014-10-21 16:20 - 2014-03-18 11:53 - 01921090 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-10-21 04:24 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache

2014-10-21 00:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF

2014-10-16 22:47 - 2014-09-19 12:02 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Packages

2014-10-16 19:58 - 2014-09-19 11:41 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9EEBF207-CFCB-43C0-B7A7-45B2F06D4561}

2014-10-16 18:13 - 2014-09-19 11:38 - 00000000 ____D () C:\Users\Stephan\Documents\Youcam

2014-10-16 18:10 - 2014-09-22 16:40 - 00002169 _____ () C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk

2014-10-16 13:33 - 2014-06-12 13:03 - 00000000 ____D () C:\ProgramData\McAfee

2014-10-16 13:33 - 2014-06-12 13:03 - 00000000 ____D () C:\Program Files (x86)\McAfee

2014-10-16 13:31 - 2014-05-07 10:41 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection

2014-10-16 13:17 - 2013-08-22 16:44 - 00492032 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData

2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore

2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\MediaViewer

2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\FileManager

2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Camera

2014-10-16 07:23 - 2014-09-20 16:03 - 00000000 ____D () C:\Users\Stephan\Documents\Outlook-Dateien

2014-10-15 07:09 - 2014-09-19 21:07 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-10-15 07:04 - 2014-09-21 01:18 - 00000000 ____D () C:\Windows\system32\MRT

2014-10-15 06:47 - 2014-09-21 01:18 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-10-15 06:45 - 2014-09-22 13:32 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-10-14 19:41 - 2014-06-12 12:39 - 00000000 ____D () C:\ProgramData\Package Cache

2014-10-12 19:05 - 2014-09-22 12:53 - 00000000 ____D () C:\Users\Stephan\Desktop\Rechnungen 

2014-10-11 10:06 - 2014-09-19 11:35 - 00000000 ____D () C:\Users\Stephan

2014-10-09 23:17 - 2014-09-19 21:34 - 00000000 ____D () C:\beide

2014-10-07 00:54 - 2014-06-12 13:02 - 00000000 ____D () C:\Users\Public\CyberLink

2014-10-07 00:53 - 2014-09-19 11:38 - 00000000 ____D () C:\Users\Stephan\AppData\Local\CyberLink

2014-10-07 00:53 - 2014-06-12 12:51 - 00000000 ____D () C:\ProgramData\CyberLink

2014-10-07 00:53 - 2014-05-07 19:34 - 00000000 ___HD () C:\HP

2014-09-30 22:41 - 2014-06-12 12:43 - 00000000 ____D () C:\ProgramData\Apple

2014-09-30 00:45 - 2014-09-22 13:39 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-09-30 00:45 - 2014-09-22 13:39 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-09-26 19:37 - 2014-03-18 11:38 - 00000000 ____D () C:\Program Files\Windows Journal

2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel

2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\setup

2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\setup

2014-09-26 19:37 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\oobe

2014-09-25 22:20 - 2013-08-22 15:25 - 00000301 _____ () C:\Windows\win.ini

2014-09-25 21:32 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\InputMethod

2014-09-25 21:10 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\registration

2014-09-25 21:09 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\Sysprep
 

Some content of TEMP:

====================

C:\Users\Mimi\AppData\Local\Temp\avgnt.exe

C:\Users\Mimi\AppData\Local\Temp\sqlite3.dll

C:\Users\Stephan\AppData\Local\Temp\AdhL1.exe

C:\Users\Stephan\AppData\Local\Temp\avgnt.exe

C:\Users\Stephan\AppData\Local\Temp\BackupSetup.exe

C:\Users\Stephan\AppData\Local\Temp\EdSD9.dll

C:\Users\Stephan\AppData\Local\Temp\EdSD9.exe

C:\Users\Stephan\AppData\Local\Temp\jzdp9.dll

C:\Users\Stephan\AppData\Local\Temp\jzdp9.exe

C:\Users\Stephan\AppData\Local\Temp\OnlineBackup.exe

C:\Users\Stephan\AppData\Local\Temp\setup_337.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-21 00:01
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2014-10-23 18:17:33

Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000026 HGST_HTS541075A9E680 rev.JA2OA710 698,64GB

Running: Gmer-19357.exe; Driver: C:\Users\Mimi\AppData\Local\Temp\uwldypoc.sys
 
 

---- Kernel code sections - GMER 2.1 ----
 

.text   C:\Windows\System32\win32k.sys!W32pServiceTable                                                                                 fffff9600013be00 15 bytes [00, F1, F6, 01, 40, 8F, 6C, ...]

.text   C:\Windows\System32\win32k.sys!W32pServiceTable + 16                                                                            fffff9600013be10 11 bytes [00, 6D, FC, FF, 00, A3, C3, ...]
 

---- User code sections - GMER 2.1 ----
 

.text   C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe[924] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506            00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe[924] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514            00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe[924] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118               00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe[924] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142               00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5740] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506                      00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5740] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514                      00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5740] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                         00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5740] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                         00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]

.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4468] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506                   00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]

.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4468] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514                   00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]

.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4468] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                      00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]

.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4468] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                      00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe[7716] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506             00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe[7716] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514             00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe[7716] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe[7716] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe[6204] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506         00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe[6204] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514         00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe[6204] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118            00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe[6204] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142            00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe[6184] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506        00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe[6184] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514        00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe[6184] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118           00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe[6184] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142           00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\opbhobrokerdsktop.exe[5364] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506  00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\opbhobrokerdsktop.exe[5364] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514  00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\opbhobrokerdsktop.exe[5364] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118     00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]

.text   C:\Program Files\Hewlett-Packard\SimplePass\opbhobrokerdsktop.exe[5364] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142     00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]
 

---- Threads - GMER 2.1 ----
 

Thread  C:\Windows\system32\csrss.exe [7940:4232]                                                                                       fffff96000947b90
 

---- Disk sectors - GMER 2.1 ----
 

Disk    \Device\Harddisk0\DR0                                                                                                           unknown MBR code
 

---- EOF - GMER 2.1 ----

Möchtest du die anderen txt. Dokumente auch gleich haben?

Code:

# AdwCleaner v4.000 - Bericht erstellt am 20/10/2014 um 23:10:01

# DB v2014-10-19.11

# Aktualisiert 12/10/2014 von Xplode

# Betriebssystem : Windows 8.1  (64 bits)

# Benutzername : Mimi - STEPPO

# Gestartet von : C:\Users\Mimi\Desktop\AdwCleaner_4.000.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

[#] Dienst Gelöscht : globalUpdate

[#] Dienst Gelöscht : globalUpdatem

Dienst Gelöscht : Scores

Dienst Gelöscht : {6eaeb8af-e4d9-4df5-b9d7-815f2928cdf7}Gw64
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\374311380 

Ordner Gelöscht : C:\Program Files (x86)\Bench

Ordner Gelöscht : C:\Program Files (x86)\globalUpdate

Ordner Gelöscht : C:\Users\Mimi\AppData\Local\globalUpdate

Ordner Gelöscht : C:\Users\Stephan\AppData\Local\globalUpdate

Ordner Gelöscht : C:\Users\Stephan\Documents\Optimizer Pro

Ordner Gelöscht : C:\Users\Mimi\AppData\Local\Pokki

Ordner Gelöscht : C:\Users\Public\Pokki

Ordner Gelöscht : C:\Users\Stephan\AppData\Local\Pokki

Ordner Gelöscht : C:\Program Files (x86)\predm

Ordner Gelöscht : C:\Users\Stephan\AppData\Roaming\Systweak

Ordner Gelöscht : C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage

Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect

Ordner Gelöscht : C:\Program Files (x86)\CinPl-2.5cV14.10

Ordner Gelöscht : C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\Extensions\3c8f3083-413b-4aa6-ad29-fb93d8982e80@gmail.com

Ordner Gelöscht : C:\Users\Stephan\AppData\Roaming\Mozilla\Firefox\Profiles\nbpps1a8.default\Extensions\3c8f3083-413b-4aa6-ad29-fb93d8982e80@gmail.com

Datei Gelöscht : C:\END

Datei Gelöscht : C:\Windows\System32\roboot64.exe

Datei Gelöscht : C:\Windows\score.exe

Datei Gelöscht : C:\Users\Stephan\AppData\Local\Temp\VOPackage.exe

Datei Gelöscht : C:\Windows\System32\\drivers\{6eaeb8af-e4d9-4df5-b9d7-815f2928cdf7}Gw64.sys

Datei Gelöscht : C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\searchplugins\Web Search.xml

Datei Gelöscht : C:\Users\Stephan\AppData\Roaming\Mozilla\Firefox\Profiles\nbpps1a8.default\searchplugins\Web Search.xml
 

***** [ Tasks ] *****
 

Task Gelöscht : ASP

Task Gelöscht : globalUpdateUpdateTaskMachineCore

Task Gelöscht : globalUpdateUpdateTaskMachineUA

Task Gelöscht : LaunchSignup

Task Gelöscht : Optimizer Pro Schedule

Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-1

Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-11

Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-2

Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-3

Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-4

Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-5

Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-5_user
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [termtutor@termtutor.com]

Schlüssel Gelöscht : HKCU\Software\Classes\pokki

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Pokki]

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10

Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110611311167}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622312267}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655315567}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666316667}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440644314467}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611311167}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110611311167}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622312267}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655315567}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666316667}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611311167}

Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}

Schlüssel Gelöscht : HKCU\Software\GlobalUpdate

Schlüssel Gelöscht : HKCU\Software\InetStat

Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions

Schlüssel Gelöscht : HKCU\Software\PepperZip

Schlüssel Gelöscht : HKCU\Software\Pokki

Schlüssel Gelöscht : HKCU\Software\Proxy

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\CinPl-2.5cV14.10

Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

Schlüssel Gelöscht : HKLM\SOFTWARE\AdvertisingSupport

Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate

Schlüssel Gelöscht : HKLM\SOFTWARE\InstalledBrowserExtensions

Schlüssel Gelöscht : HKLM\SOFTWARE\MyBestOffersToday

Schlüssel Gelöscht : HKLM\SOFTWARE\supWindowsMangerProtect

Schlüssel Gelöscht : HKLM\SOFTWARE\systweak

Schlüssel Gelöscht : HKLM\SOFTWARE\Tutorials

Schlüssel Gelöscht : HKLM\SOFTWARE\CinPl-2.5cV14.10

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17344
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
 

-\\ Mozilla Firefox v
 

[7ki9jzgc.default] - Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_CN_Cx0CEU-cMTeldOutkMQym-q8CgvWqCUgJjxwOvjbHw2TbkYVPE4-BLMeojTcznWODomaIx0lQlYZkOzYwHrxK0p_uAXYW[...]

[7ki9jzgc.default] - Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_CN_Cx0CEU-cMTeldOutkMQym-q8CgvWqCUgJjxwOvjbHw2TbkYVPE4-BLMeojTcznWODomaIx0lQlYZkOzYwHr73V71O3OUIqBU_Wtt[...]

[nbpps1a8.default] - Zeile gelöscht : user_pref("extensions.a3c8f3083413b4aa6ad29fb93d8982e80gmailcom63167.63167.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2C%22amazon.com%22%[...]

[nbpps1a8.default] - Zeile gelöscht : user_pref("extensions.a3c8f3083413b4aa6ad29fb93d8982e80gmailcom63167.63167.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2C%22deal[...]

[nbpps1a8.default] - Zeile gelöscht : user_pref("extensions.crossrider.bic", "149120159f832b4c5f69a9ca1214cd52");

[nbpps1a8.default] - Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_CN_Cx0CEU-cMTeldOutkMQym-q8CgvWqCUgJjxwOvjbHw2TbkYVPE4-BLMeojTcznWODomaIx0lQlYZkOzYwHr73V71O3OUIqBU_Wtt[...]
 

*************************
 

AdwCleaner[R0].txt - [16861 octets] - [20/10/2014 23:04:40]

AdwCleaner[S0].txt - [14500 octets] - [20/10/2014 23:10:01]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14561 octets] ##########

Habe auch noch otl, jrt, malware und avira files...

MBAM und JRT ebenso laufen und löschen lassen?
AdwCleaner löschen und neu laden, nochmal laufen lassen, alles entfernen, dann ein frisches FRST Log bitte.

Moin Moin, hier die frische frst + adwclean

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-10-2014

Ran by Mimi (administrator) on STEPPO on 25-10-2014 14:42:41

Running from C:\Users\Mimi\Desktop

Loaded Profile: Mimi (Available profiles: Stephan & Mimi)

Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe

() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17246_none_fa4ae8e99b1f603c\TiWorker.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe

() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\Youcam_webcam_camera_video.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7573208 2014-04-22] (Realtek Semiconductor)

HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe [3962936 2014-03-28] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [415288 2014-03-28] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [415288 2014-03-28] (Hewlett-Packard)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2811120 2014-03-13] (Synaptics Incorporated)

HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [126240 2014-02-13] (Hewlett-Packard Company)

HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [475448 2014-03-26] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-09-24] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

BootExecute: autocheck autochk * sdnclean64.exe
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPNOT14/4

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

SearchScopes: HKLM - {FE81BB90-6408-42D2-8133-29E869E8DC35} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{EFBDAE16-3547-4A0A-96FA-C59753428745}: [NameServer] 5.79.84.141,8.38.77.107
 

FireFox:

========

FF ProfilePath: C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default

FF Homepage: google.de

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()

FF Extension: No Name - C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\Extensions\cliqz@cliqz.com [2014-10-21]

FF Extension: No Name - C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\extensions\3c8f3083-413b-4aa6-ad29-fb93d8982e80@gmail.com [Not Found]

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
 

Chrome: 

=======
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-09-24] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-09-24] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)

S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2251992 2013-11-13] (Broadcom Corporation.)

R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-01-28] (WildTangent)

R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2014-01-13] (Hewlett-Packard Company) [File not signed]

R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [469304 2014-03-26] (Hewlett-Packard Development Company, L.P.)

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)

R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [200168 2013-12-04] ()

R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)

S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)

S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-05-07] (Microsoft Corporation)

R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [88064 2014-03-28] (Softex Inc.) [File not signed]

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-01-09] (Realtek Semiconductor)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)

S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)

R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [190704 2014-03-13] (Synaptics Incorporated)

S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-04-02] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-09-24] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-09-24] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-09-24] (Avira Operations GmbH & Co. KG)

R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-11-13] (Broadcom Corporation.)

R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7517872 2014-06-12] (Broadcom Corporation)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)

S3 BtwSerialBus; C:\Windows\System32\drivers\BtwSerialBus.sys [150744 2013-09-09] (Broadcom Corporation.)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91912 2013-11-12] (CyberLink)

R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [21408 2013-08-13] ()

R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [21920 2013-08-13] ()

R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [29088 2013-08-13] ()

R3 ISCT; C:\Windows\System32\drivers\ISCTD64.sys [46568 2013-08-13] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-25] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)

R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-11] (Intel Corporation)

R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [291544 2014-01-04] (Realtek Semiconductor Corp.)

U5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [466136 2014-01-15] (Realsil Semiconductor Corporation)

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2014-03-13] (Synaptics Incorporated)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-03-13] (Synaptics Incorporated)

R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-25 14:42 - 2014-10-25 14:42 - 00001199 _____ () C:\Users\Mimi\Desktop\AdwCleaner[S2].txt

2014-10-25 14:42 - 2014-10-25 14:42 - 00000000 ____D () C:\Users\Mimi\Desktop\FRST-OlderVersion

2014-10-25 14:37 - 2014-10-25 14:37 - 00001141 _____ () C:\Users\Mimi\Desktop\AdwCleaner[R3].txt

2014-10-25 14:33 - 2014-10-25 14:33 - 00000747 _____ () C:\Users\Mimi\Desktop\JRTnew.txt

2014-10-25 14:32 - 2014-10-25 14:32 - 00000747 _____ () C:\Users\Mimi\Desktop\JRT.txt

2014-10-25 14:27 - 2014-10-21 20:25 - 01706144 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT_NEW.exe

2014-10-25 14:25 - 2014-10-25 14:25 - 01962496 _____ () C:\Users\Mimi\Desktop\AdwCleaner_4.001.exe

2014-10-23 20:48 - 2014-10-23 20:48 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\00506449.sys

2014-10-23 19:16 - 2014-10-23 19:16 - 00000396 _____ () C:\Users\Mimi\Desktop\Ereignisse.txt

2014-10-23 18:17 - 2014-10-23 18:17 - 00006169 _____ () C:\Users\Mimi\Desktop\Gmer.txt

2014-10-23 18:08 - 2014-10-23 18:09 - 00028032 _____ () C:\Users\Mimi\Desktop\Addition.txt

2014-10-23 18:05 - 2014-10-25 14:42 - 00016373 _____ () C:\Users\Mimi\Desktop\FRST.txt

2014-10-23 18:05 - 2014-10-25 14:42 - 00000000 ____D () C:\FRST

2014-10-23 18:02 - 2014-10-23 18:03 - 00000470 _____ () C:\Users\Mimi\Desktop\defogger_disable.txt

2014-10-23 18:02 - 2014-10-23 18:02 - 00000000 _____ () C:\Users\Mimi\defogger_reenable

2014-10-23 17:59 - 2014-10-25 14:42 - 02112512 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe

2014-10-23 17:58 - 2014-10-23 17:56 - 00380416 _____ () C:\Users\Mimi\Desktop\Gmer-19357.exe

2014-10-23 17:58 - 2014-10-23 17:52 - 00050477 _____ () C:\Users\Mimi\Desktop\Defogger.exe

2014-10-23 17:31 - 2014-10-23 17:31 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\70474D78.sys

2014-10-21 23:53 - 2014-10-21 23:53 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Avira

2014-10-21 23:03 - 2013-08-22 15:25 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141021-230357.backup

2014-10-21 20:26 - 2014-10-21 20:26 - 00001414 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-10-21 20:26 - 2014-10-21 20:26 - 00001402 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-10-21 20:26 - 2014-10-21 20:26 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-10-21 20:26 - 2014-10-21 20:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-10-21 20:25 - 2014-10-21 22:46 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-10-21 20:25 - 2014-10-21 20:41 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-10-21 20:25 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2014-10-21 17:09 - 2014-10-21 17:09 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Avira

2014-10-21 17:06 - 2014-10-21 17:05 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-10-21 17:03 - 2014-09-24 12:44 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-10-21 17:03 - 2014-09-24 12:44 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-10-21 17:03 - 2014-09-24 12:44 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2014-10-21 16:44 - 2014-09-22 08:42 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-10-21 16:22 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll

2014-10-21 16:22 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll

2014-10-21 02:17 - 2014-10-21 02:17 - 00000000 _____ () C:\autoexec.bat

2014-10-21 02:13 - 2014-10-21 07:49 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP

2014-10-21 01:53 - 2014-10-21 01:53 - 00000000 ____D () C:\Synaptics

2014-10-21 01:51 - 2014-10-21 01:51 - 00001190 _____ () C:\Users\Mimi\Desktop\malware.txt

2014-10-21 01:22 - 2014-10-25 14:41 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-21 01:22 - 2014-10-21 01:23 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-21 01:22 - 2014-10-21 01:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-21 01:21 - 2014-10-21 01:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-21 01:21 - 2014-10-21 01:21 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-10-21 01:21 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-10-21 01:21 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-10-21 01:21 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-10-21 01:02 - 2014-10-21 01:07 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-10-21 00:04 - 2014-10-21 00:04 - 00132108 _____ () C:\Users\Mimi\Desktop\OTL1.Txt

2014-10-20 23:51 - 2014-10-21 19:45 - 00138812 _____ () C:\Users\Mimi\Desktop\OTL.Txt

2014-10-20 23:51 - 2014-10-21 00:00 - 00132108 _____ () C:\Users\Mimi\Downloads\OTL.Txt

2014-10-20 23:51 - 2014-10-20 23:51 - 00071802 _____ () C:\Users\Mimi\Downloads\Extras.Txt

2014-10-20 23:29 - 2014-10-20 23:29 - 00602112 _____ (OldTimer Tools) C:\Users\Mimi\Desktop\OTL.exe

2014-10-20 23:26 - 2014-10-20 23:26 - 00000613 _____ () C:\Users\Mimi\Desktop\JRT1.txt

2014-10-20 23:22 - 2014-10-20 23:22 - 00000000 ____D () C:\Windows\ERUNT

2014-10-20 23:20 - 2014-10-20 23:21 - 01705698 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT.exe

2014-10-20 23:17 - 2014-10-20 23:17 - 00014694 _____ () C:\Users\Mimi\Desktop\AdwCleaner[S0].txt

2014-10-20 23:04 - 2014-10-25 14:38 - 00000000 ____D () C:\AdwCleaner

2014-10-16 21:10 - 2014-10-20 22:34 - 00002166 _____ () C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk

2014-10-16 21:10 - 2014-10-16 21:10 - 00002337 _____ () C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk

2014-10-16 13:26 - 2014-10-16 13:26 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Opera Software

2014-10-16 13:26 - 2014-10-16 13:26 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Opera Software

2014-10-15 06:31 - 2014-09-28 00:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-15 06:31 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll

2014-10-15 06:31 - 2014-09-04 01:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll

2014-10-15 06:31 - 2014-09-04 01:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll

2014-10-15 06:30 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-10-15 06:30 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-10-15 06:29 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-10-15 06:29 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-10-15 06:29 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-10-15 06:29 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-10-15 06:29 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-10-15 06:29 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-10-15 06:29 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-10-15 06:29 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-10-15 06:29 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-10-15 06:29 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-10-15 06:29 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-10-15 06:29 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-10-15 06:29 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-10-15 06:29 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-10-15 06:29 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-10-15 06:29 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-10-15 06:29 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-10-15 06:29 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-10-15 06:29 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-10-15 06:29 - 2014-09-19 02:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-10-15 06:29 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-10-15 06:29 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-10-15 06:29 - 2014-09-19 02:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-10-15 06:29 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-10-15 06:29 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-10-15 06:29 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-10-15 06:29 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-10-15 06:29 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-10-15 06:28 - 2014-09-13 08:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-10-15 06:28 - 2014-09-13 07:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-10-15 06:28 - 2014-09-08 05:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-10-15 06:28 - 2014-09-08 03:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-10-15 06:28 - 2014-09-08 03:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-10-15 06:28 - 2014-09-08 02:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-10-15 06:28 - 2014-09-08 02:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-10-15 06:28 - 2014-09-08 02:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-10-15 06:28 - 2014-09-08 02:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2014-10-15 06:28 - 2014-09-08 02:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-10-15 06:28 - 2014-09-08 02:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-10-15 06:28 - 2014-09-08 02:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-10-15 06:28 - 2014-09-08 01:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-10-15 06:28 - 2014-09-08 01:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-10-15 06:28 - 2014-09-08 01:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-10-15 06:28 - 2014-09-08 01:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-10-15 06:27 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll

2014-10-15 06:27 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll

2014-10-15 06:27 - 2014-08-16 06:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-10-15 06:27 - 2014-08-16 06:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll

2014-10-15 06:27 - 2014-08-16 06:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2014-10-15 06:27 - 2014-08-16 05:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-10-15 06:27 - 2014-08-16 05:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-10-15 06:27 - 2014-08-16 05:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-10-15 06:27 - 2014-08-16 05:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-10-15 06:27 - 2014-08-16 05:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll

2014-10-15 06:27 - 2014-08-16 05:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2014-10-15 06:27 - 2014-08-16 03:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-10-15 06:27 - 2014-08-16 03:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll

2014-10-15 06:27 - 2014-08-16 02:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll

2014-10-15 06:27 - 2014-08-16 02:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll

2014-10-15 06:27 - 2014-08-16 02:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll

2014-10-15 06:27 - 2014-08-16 02:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll

2014-10-15 06:27 - 2014-08-16 02:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll

2014-10-15 06:27 - 2014-08-16 02:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll

2014-10-15 06:27 - 2014-08-16 02:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll

2014-10-15 06:27 - 2014-08-16 02:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll

2014-10-15 06:27 - 2014-08-16 02:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-15 06:27 - 2014-08-16 02:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll

2014-10-15 06:27 - 2014-08-16 02:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll

2014-10-15 06:27 - 2014-08-16 02:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll

2014-10-15 06:27 - 2014-08-16 02:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-15 06:27 - 2014-08-16 02:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll

2014-10-15 06:27 - 2014-08-16 02:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll

2014-10-15 06:27 - 2014-08-16 02:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll

2014-10-15 06:27 - 2014-08-16 02:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-15 06:27 - 2014-08-16 02:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll

2014-10-15 06:27 - 2014-08-16 02:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll

2014-10-15 06:27 - 2014-08-16 02:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll

2014-10-15 06:27 - 2014-08-16 02:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe

2014-10-15 06:27 - 2014-08-16 02:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-10-15 06:27 - 2014-08-16 02:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll

2014-10-15 06:27 - 2014-08-01 01:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml

2014-10-15 06:26 - 2014-10-10 00:16 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-10-15 06:26 - 2014-10-09 00:09 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-10-15 06:26 - 2014-09-19 03:24 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-10-15 06:26 - 2014-09-13 08:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-15 06:26 - 2014-09-13 07:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-10-15 06:26 - 2014-08-29 03:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll

2014-10-15 06:26 - 2014-08-29 01:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-10-15 06:26 - 2014-08-29 01:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-10-15 06:14 - 2014-10-15 06:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-10-15 06:11 - 2014-10-25 14:41 - 00001358 _____ () C:\Windows\Tasks\BHWWS.job

2014-10-15 06:11 - 2014-10-15 06:11 - 00004364 _____ () C:\Windows\System32\Tasks\BHWWS

2014-10-15 06:10 - 2014-10-25 14:41 - 00001708 _____ () C:\Windows\Tasks\DTTZBVQB.job

2014-10-15 06:10 - 2014-10-15 06:10 - 00004714 _____ () C:\Windows\System32\Tasks\DTTZBVQB

2014-10-09 22:19 - 2014-10-16 13:26 - 00003842 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1412885971

2014-10-09 22:19 - 2014-10-16 13:26 - 00001158 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2014-10-09 22:19 - 2014-10-16 13:26 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-10-09 22:19 - 2014-10-09 22:19 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Opera Software

2014-10-09 22:19 - 2014-10-09 22:19 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Opera Software

2014-10-07 00:55 - 2014-10-07 00:55 - 00000000 ____D () C:\Users\Stephan\Documents\Avatar

2014-10-07 00:54 - 2014-10-07 00:54 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\CyberLink

2014-10-07 00:52 - 2014-10-07 00:52 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Apple Computer

2014-10-06 23:33 - 2014-10-21 17:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-10-06 23:32 - 2014-10-21 17:03 - 00000000 ____D () C:\ProgramData\Avira

2014-10-06 23:32 - 2014-10-21 17:03 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-10-06 16:59 - 2014-10-06 16:59 - 00000000 ____D () C:\Users\Mimi\Documents\web

2014-10-06 14:45 - 2014-10-06 14:45 - 00002522 _____ () C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

2014-10-06 05:58 - 2014-10-06 05:58 - 00000000 ____D () C:\Users\Mimi\AppData\Local\CrashDumps

2014-10-01 05:28 - 2014-10-15 06:39 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Apple Computer

2014-09-30 22:46 - 2014-09-30 22:55 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Apple Computer

2014-09-30 22:46 - 2014-09-30 22:46 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Apple Computer

2014-09-30 22:46 - 2014-09-30 22:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-09-30 22:44 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys

2014-09-30 22:43 - 2014-09-30 22:44 - 00000000 ____D () C:\Program Files\iTunes

2014-09-30 22:43 - 2014-09-30 22:44 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-09-30 22:43 - 2014-09-30 22:43 - 00000000 ____D () C:\ProgramData\Apple Computer

2014-09-30 22:43 - 2014-09-30 22:43 - 00000000 ____D () C:\Program Files\iPod

2014-09-30 22:41 - 2014-09-30 22:41 - 00002535 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

2014-09-30 22:41 - 2014-09-30 22:41 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Apple

2014-09-30 22:41 - 2014-09-30 22:41 - 00000000 ____D () C:\Program Files\Common Files\Apple

2014-09-30 22:41 - 2014-09-30 22:41 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update

2014-09-28 11:14 - 2014-10-02 07:03 - 00000000 ____D () C:\Users\Stephan\Desktop\Flohmarkt1

2014-09-26 11:35 - 2014-09-26 11:36 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Mozilla

2014-09-26 11:35 - 2014-09-26 11:36 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Mozilla

2014-09-25 22:39 - 2014-09-25 22:39 - 00003130 _____ () C:\Windows\System32\Tasks\{00B59D34-BE6F-4EDF-8D3B-A9BBBA3CCEB6}
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-25 14:43 - 2014-09-19 12:03 - 00000000 ____D () C:\Users\Mimi\Documents\Youcam

2014-10-25 14:41 - 2014-09-19 12:11 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2446055026-3567564273-3713566540-1004

2014-10-25 14:39 - 2014-03-18 11:44 - 00410048 _____ () C:\Windows\PFRO.log

2014-10-25 14:39 - 2013-08-22 16:46 - 00032332 _____ () C:\Windows\setupact.log

2014-10-25 14:39 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-25 14:38 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI

2014-10-25 14:15 - 2014-09-19 11:33 - 01914458 _____ () C:\Windows\WindowsUpdate.log

2014-10-25 14:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru

2014-10-25 13:43 - 2014-09-19 12:17 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{EBD4C036-B3CB-4392-808C-89DA60C8B663}

2014-10-23 20:09 - 2014-09-19 12:02 - 00000000 ____D () C:\Users\Mimi

2014-10-23 19:58 - 2014-09-19 11:41 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2446055026-3567564273-3713566540-1001

2014-10-23 18:31 - 2014-09-19 11:41 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9EEBF207-CFCB-43C0-B7A7-45B2F06D4561}

2014-10-23 17:34 - 2014-09-23 22:42 - 00000000 ____D () C:\Users\Mimi\Documents\Outlook-Dateien

2014-10-21 23:59 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness

2014-10-21 22:59 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp

2014-10-21 16:55 - 2013-08-22 17:36 - 00000000 ___HD () C:\Windows\ELAMBKUP

2014-10-21 16:54 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM

2014-10-21 16:20 - 2014-05-07 19:54 - 00800954 _____ () C:\Windows\system32\perfh007.dat

2014-10-21 16:20 - 2014-05-07 19:54 - 00174458 _____ () C:\Windows\system32\perfc007.dat

2014-10-21 16:20 - 2014-03-18 11:53 - 01921090 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-10-21 04:24 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache

2014-10-21 00:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF

2014-10-16 22:47 - 2014-09-19 12:02 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Packages

2014-10-16 18:13 - 2014-09-19 11:38 - 00000000 ____D () C:\Users\Stephan\Documents\Youcam

2014-10-16 18:10 - 2014-09-22 16:40 - 00002169 _____ () C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk

2014-10-16 18:06 - 2014-09-23 22:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-10-16 13:33 - 2014-06-12 13:03 - 00000000 ____D () C:\ProgramData\McAfee

2014-10-16 13:33 - 2014-06-12 13:03 - 00000000 ____D () C:\Program Files (x86)\McAfee

2014-10-16 13:31 - 2014-05-07 10:41 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection

2014-10-16 13:20 - 2014-09-24 20:10 - 00000000 ___HD () C:\Users\Public\Temp

2014-10-16 13:17 - 2013-08-22 16:44 - 00492032 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData

2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore

2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\MediaViewer

2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\FileManager

2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Camera

2014-10-16 07:23 - 2014-09-20 16:03 - 00000000 ____D () C:\Users\Stephan\Documents\Outlook-Dateien

2014-10-15 07:09 - 2014-09-19 21:07 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-10-15 07:04 - 2014-09-21 01:18 - 00000000 ____D () C:\Windows\system32\MRT

2014-10-15 06:47 - 2014-09-21 01:18 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-10-15 06:45 - 2014-09-22 13:32 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-10-14 19:41 - 2014-06-12 12:39 - 00000000 ____D () C:\ProgramData\Package Cache

2014-10-12 19:05 - 2014-09-22 12:53 - 00000000 ____D () C:\Users\Stephan\Desktop\Rechnungen Möbeltaxi

2014-10-11 10:06 - 2014-09-19 11:35 - 00000000 ____D () C:\Users\Stephan

2014-10-09 23:17 - 2014-09-19 21:34 - 00000000 ____D () C:\beide

2014-10-07 00:54 - 2014-06-12 13:02 - 00000000 ____D () C:\Users\Public\CyberLink

2014-10-07 00:53 - 2014-09-19 11:38 - 00000000 ____D () C:\Users\Stephan\AppData\Local\CyberLink

2014-10-07 00:53 - 2014-06-12 12:51 - 00000000 ____D () C:\ProgramData\CyberLink

2014-10-07 00:53 - 2014-05-07 19:34 - 00000000 ___HD () C:\HP

2014-09-30 22:41 - 2014-06-12 12:43 - 00000000 ____D () C:\ProgramData\Apple

2014-09-30 00:45 - 2014-09-22 13:39 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-09-30 00:45 - 2014-09-22 13:39 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-09-26 19:37 - 2014-03-18 11:38 - 00000000 ____D () C:\Program Files\Windows Journal

2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel

2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\setup

2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\setup

2014-09-26 19:37 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\oobe

2014-09-26 06:53 - 2014-09-24 06:41 - 00000000 ____D () C:\Users\Stephan\AppData\Local\CrashDumps

2014-09-25 22:20 - 2013-08-22 15:25 - 00000301 _____ () C:\Windows\win.ini

2014-09-25 21:32 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\InputMethod

2014-09-25 21:10 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\registration

2014-09-25 21:09 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\Sysprep
 

Some content of TEMP:

====================

C:\Users\Mimi\AppData\Local\Temp\avgnt.exe

C:\Users\Mimi\AppData\Local\Temp\Quarantine.exe

C:\Users\Mimi\AppData\Local\Temp\sqlite3.dll

C:\Users\Stephan\AppData\Local\Temp\AdhL1.exe

C:\Users\Stephan\AppData\Local\Temp\avgnt.exe

C:\Users\Stephan\AppData\Local\Temp\BackupSetup.exe

C:\Users\Stephan\AppData\Local\Temp\EdSD9.dll

C:\Users\Stephan\AppData\Local\Temp\EdSD9.exe

C:\Users\Stephan\AppData\Local\Temp\jzdp9.dll

C:\Users\Stephan\AppData\Local\Temp\jzdp9.exe

C:\Users\Stephan\AppData\Local\Temp\OnlineBackup.exe

C:\Users\Stephan\AppData\Local\Temp\setup_337.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-21 00:01
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:

# AdwCleaner v4.001 - Bericht erstellt am 25/10/2014 um 14:38:07

# DB v2014-10-23.2

# Aktualisiert 20/10/2014 von Xplode

# Betriebssystem : Windows 8.1  (64 bits)

# Benutzername : Mimi - STEPPO

# Gestartet von : C:\Users\Mimi\Desktop\AdwCleaner_4.001.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

[#] Dienst Gelöscht : KMService
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
 

***** [ Browser ] *****
 

-\\ Internet Explorer v0.0.0.0
 
 

-\\ Mozilla Firefox v
 
 

*************************
 

AdwCleaner[R0].txt - [16861 octets] - [20/10/2014 23:04:40]

AdwCleaner[R1].txt - [7275 octets] - [21/10/2014 23:14:07]

AdwCleaner[R2].txt - [963 octets] - [21/10/2014 23:22:04]

AdwCleaner[R3].txt - [1141 octets] - [25/10/2014 14:33:30]

AdwCleaner[S0].txt - [14694 octets] - [20/10/2014 23:10:01]

AdwCleaner[S1].txt - [7282 octets] - [21/10/2014 23:17:23]

AdwCleaner[S2].txt - [1059 octets] - [25/10/2014 14:38:07]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1119 octets] ##########

Leider öffnen sich immer noch eigenständig folgende tabs: icmwebserv.com; alh.gogorithm.com/WLBidRequestHandler; png.mecoolidea.com wird von malwarebytes geblockt.

In allen Browsern oder nur in einem speziellen?

habe zzt. nur den Opera Browser laufen. Soll ich die anderen noch mal durchtesten?

Ich lösche Opera mal und probiere die anderen - wobei Opera jetzt schon nach dem Explorer und Firefox mein dritter Browser-Versuch war...

Habe noch mal neue Browserversionen über chip heruntergeladen und und installiert. In diesem Zuge hat sich auch wieder cliqz mit firefox im Hintergrung installiert und sowohl adwarecleaner als auch spybot haben weiterhin Funde gemeldet. Ich poste gleich das logfile. Der Laptop ist auch weiterhin sehr langsam und die Browser musste ich über einen Stick imporieren weil die Browserwahl über microsoft nicht funktioniert hat.

Code:

Search results from Spybot - Search & Destroy
 

26.10.2014 14:31:08

Scan took 00:45:50.

16 items found.
 

7-Zip: [SBI $12C3A52C] Folder history (Registry Value, nothing done)

  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1004\Software\7-ZIP\FM\FolderHistory
 

7-Zip: [SBI $3D5692BD] Last used folder (Registry Change, nothing done)

  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1004\Software\7-ZIP\FM\PanelPath0
 

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)

  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1001\Software\Microsoft\Internet Explorer\TypedURLs
 

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)

  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\TypedURLs
 

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)

  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1004\Software\Microsoft\Internet Explorer\TypedURLs
 

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)

  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
 

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)

  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
 

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)

  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
 

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
 

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
 

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)

  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
 

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)

  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
 

Cookie: [SBI $49804B54] Browser: Cookie (8) (Browser: Cookie, nothing done)

  
 

Cache: [SBI $49804B54] Browser: Cache (127) (Browser: Cache, nothing done)

  
 

Verlauf: [SBI $49804B54] Browser: History (43) (Browser: History, nothing done)

  
 

Cookie: [SBI $49804B54] Browser: Cookie (71) (Browser: Cookie, nothing done)

  
 
 

--- Spybot - Search & Destroy version: 2.4.40.131  DLL (build: 20140425) ---
 

2014-06-24 blindman.exe (2.4.40.151)

2014-06-24 explorer.exe (2.4.40.181)

2014-06-24 SDBootCD.exe (2.4.40.109)

2014-06-24 SDCleaner.exe (2.4.40.110)

2014-06-24 SDDelFile.exe (2.4.40.94)

2013-06-17 SDDisableProxy.exe

2014-06-24 SDFiles.exe (2.4.40.135)

2014-06-24 SDFileScanHelper.exe (2.4.40.1)

2014-06-24 SDFSSvc.exe (2.4.40.217)

2014-06-24 SDHelp.exe (2.4.40.1)

2014-04-25 SDHookHelper.exe (2.3.39.2)

2014-04-25 SDHookInst32.exe (2.3.39.2)

2014-04-25 SDHookInst64.exe (2.3.39.2)

2014-06-24 SDImmunize.exe (2.4.40.130)

2014-06-24 SDLogReport.exe (2.4.40.107)

2014-06-24 SDOnAccess.exe (2.4.40.11)

2014-06-24 SDPESetup.exe (2.4.40.3)

2014-06-24 SDPEStart.exe (2.4.40.86)

2014-06-24 SDPhoneScan.exe (2.4.40.28)

2014-06-24 SDPRE.exe (2.4.40.22)

2014-06-24 SDPrepPos.exe (2.4.40.15)

2014-06-24 SDQuarantine.exe (2.4.40.103)

2014-06-24 SDRootAlyzer.exe (2.4.40.116)

2014-06-24 SDSBIEdit.exe (2.4.40.39)

2014-06-24 SDScan.exe (2.4.40.181)

2014-06-24 SDScript.exe (2.4.40.54)

2014-06-24 SDSettings.exe (2.4.40.139)

2014-06-24 SDShell.exe (2.4.40.2)

2014-06-24 SDShred.exe (2.4.40.108)

2014-06-24 SDSysRepair.exe (2.4.40.102)

2014-06-24 SDTools.exe (2.4.40.157)

2014-06-24 SDTray.exe (2.4.40.129)

2014-06-27 SDUpdate.exe (2.4.40.94)

2014-06-27 SDUpdSvc.exe (2.4.40.77)

2014-06-24 SDWelcome.exe (2.4.40.130)

2014-04-25 SDWSCSvc.exe (2.3.39.2)

2014-05-20 spybotsd2-install-bdcore-update.exe (2.3.39.0)

2014-07-30 spybotsd2-translation-esx.exe

2013-06-18 spybotsd2-translation-frx.exe

2014-08-24 spybotsd2-translation-hux2.exe

2014-09-30 spybotsd2-translation-nlx2.exe

2014-10-21 unins000.exe (51.1052.0.0)

1999-12-02 xcacls.exe

2012-08-23 borlndmm.dll (10.0.2288.42451)

2012-09-05 DelZip190.dll (1.9.0.107)

2012-09-10 libeay32.dll (1.0.0.4)

2012-09-10 libssl32.dll (1.0.0.4)

2014-04-25 NotificationSpreader.dll

2014-06-24 SDAdvancedCheckLibrary.dll (2.4.40.98)

2014-04-25 SDAV.dll

2014-06-24 SDECon32.dll (2.4.40.114)

2014-06-24 SDECon64.dll (2.3.39.113)

2014-06-24 SDEvents.dll (2.4.40.2)

2014-06-24 SDFileScanLibrary.dll (2.4.40.14)

2014-04-25 SDHook32.dll (2.3.39.2)

2014-04-25 SDHook64.dll (2.3.39.2)

2014-06-24 SDImmunizeLibrary.dll (2.4.40.2)

2014-06-24 SDLicense.dll (2.4.40.0)

2014-06-24 SDLists.dll (2.4.40.4)

2014-06-24 SDResources.dll (2.4.40.7)

2014-06-24 SDScanLibrary.dll (2.4.40.131)

2014-06-24 SDTasks.dll (2.4.40.15)

2014-06-24 SDWinLogon.dll (2.4.40.0)

2012-08-23 sqlite3.dll

2012-09-10 ssleay32.dll (1.0.0.4)

2014-06-24 Tools.dll (2.4.40.36)

2014-03-04 Includes\Adware-000.sbi (*)

2014-01-07 Includes\Adware-001.sbi (*)

2014-10-13 Includes\Adware-C.sbi (*)

2014-01-12 Includes\Adware.sbi (*)

2014-01-12 Includes\AdwareC.sbi (*)

2010-08-13 Includes\Cookies.sbi (*)

2014-01-07 Includes\Dialer-000.sbi (*)

2014-01-07 Includes\Dialer-001.sbi (*)

2014-01-07 Includes\Dialer-C.sbi (*)

2014-01-12 Includes\Dialer.sbi (*)

2014-01-12 Includes\DialerC.sbi (*)

2014-01-08 Includes\Fraud-000.sbi (*)

2014-01-08 Includes\Fraud-001.sbi (*)

2014-03-30 Includes\Fraud-002.sbi (*)

2014-01-08 Includes\Fraud-003.sbi (*)

2012-11-13 Includes\HeavyDuty.sbi (*)

2014-01-07 Includes\Hijackers-000.sbi (*)

2014-01-07 Includes\Hijackers-001.sbi (*)

2014-01-07 Includes\Hijackers-C.sbi (*)

2014-01-12 Includes\Hijackers.sbi (*)

2014-01-12 Includes\HijackersC.sbi (*)

2014-01-07 Includes\iPhone-000.sbi (*)

2014-01-07 Includes\iPhone.sbi (*)

2014-01-07 Includes\Keyloggers-000.sbi (*)

2014-09-23 Includes\Keyloggers-C.sbi (*)

2014-01-12 Includes\Keyloggers.sbi (*)

2014-01-12 Includes\KeyloggersC.sbi (*)

2014-10-06 Includes\Malware-000.sbi (*)

2014-01-08 Includes\Malware-001.sbi (*)

2014-01-08 Includes\Malware-002.sbi (*)

2014-02-04 Includes\Malware-003.sbi (*)

2014-01-27 Includes\Malware-004.sbi (*)

2014-04-14 Includes\Malware-005.sbi (*)

2014-02-25 Includes\Malware-006.sbi (*)

2014-01-08 Includes\Malware-007.sbi (*)

2014-10-13 Includes\Malware-C.sbi (*)

2014-01-12 Includes\Malware.sbi (*)

2013-12-22 Includes\MalwareC.sbi (*)

2014-01-14 Includes\PUPS-000.sbi (*)

2014-01-14 Includes\PUPS-001.sbi (*)

2014-01-14 Includes\PUPS-002.sbi (*)

2014-10-13 Includes\PUPS-C.sbi (*)

2012-11-13 Includes\PUPS.sbi (*)

2014-01-06 Includes\PUPSC.sbi (*)

2014-01-07 Includes\Security-000.sbi (*)

2014-01-07 Includes\Security-C.sbi (*)

2014-01-20 Includes\Security.sbi (*)

2014-01-20 Includes\SecurityC.sbi (*)

2014-01-07 Includes\Spyware-000.sbi (*)

2014-01-07 Includes\Spyware-001.sbi (*)

2014-01-07 Includes\Spyware-C.sbi (*)

2014-01-20 Includes\Spyware.sbi (*)

2014-01-20 Includes\SpywareC.sbi (*)

2011-06-06 Includes\Tracks.sbi (*)

2012-11-18 Includes\Tracks.uti (*)

2014-01-14 Includes\Trojans-000.sbi (*)

2014-01-14 Includes\Trojans-001.sbi (*)

2014-01-14 Includes\Trojans-002.sbi (*)

2014-01-14 Includes\Trojans-003.sbi (*)

2014-01-14 Includes\Trojans-004.sbi (*)

2014-03-18 Includes\Trojans-005.sbi (*)

2014-07-08 Includes\Trojans-006.sbi (*)

2014-01-14 Includes\Trojans-007.sbi (*)

2014-07-08 Includes\Trojans-008.sbi (*)

2014-07-08 Includes\Trojans-009.sbi (*)

2014-10-13 Includes\Trojans-C.sbi (*)

2014-01-14 Includes\Trojans-OG-000.sbi (*)

2014-01-14 Includes\Trojans-TD-000.sbi (*)

2014-01-14 Includes\Trojans-VM-000.sbi (*)

2014-01-14 Includes\Trojans-VM-001.sbi (*)

2014-01-14 Includes\Trojans-VM-002.sbi (*)

2014-01-14 Includes\Trojans-VM-003.sbi (*)

2014-01-14 Includes\Trojans-VM-004.sbi (*)

2014-01-14 Includes\Trojans-VM-005.sbi (*)

2014-01-14 Includes\Trojans-VM-006.sbi (*)

2014-01-14 Includes\Trojans-VM-007.sbi (*)

2014-01-14 Includes\Trojans-VM-008.sbi (*)

2014-01-14 Includes\Trojans-VM-009.sbi (*)

2014-01-14 Includes\Trojans-VM-010.sbi (*)

2014-01-14 Includes\Trojans-VM-011.sbi (*)

2014-01-14 Includes\Trojans-VM-012.sbi (*)

2014-01-14 Includes\Trojans-VM-013.sbi (*)

2014-01-14 Includes\Trojans-VM-014.sbi (*)

2014-01-14 Includes\Trojans-VM-015.sbi (*)

2014-01-14 Includes\Trojans-VM-016.sbi (*)

2014-01-14 Includes\Trojans-VM-017.sbi (*)

2014-01-14 Includes\Trojans-VM-018.sbi (*)

2014-01-14 Includes\Trojans-VM-019.sbi (*)

2014-01-14 Includes\Trojans-VM-020.sbi (*)

2014-01-14 Includes\Trojans-VM-021.sbi (*)

2014-01-14 Includes\Trojans-VM-022.sbi (*)

2014-01-14 Includes\Trojans-VM-023.sbi (*)

2014-01-14 Includes\Trojans-VM-024.sbi (*)

2014-01-14 Includes\Trojans-ZB-000.sbi (*)

2014-01-14 Includes\Trojans-ZL-000.sbi (*)

2014-01-08 Includes\Trojans.sbi (*)

2014-01-15 Includes\TrojansC-01.sbi (*)

2014-01-15 Includes\TrojansC-02.sbi (*)

2014-01-15 Includes\TrojansC-03.sbi (*)

2014-01-15 Includes\TrojansC-04.sbi (*)

2014-01-15 Includes\TrojansC-05.sbi (*)

2014-01-08 Includes\TrojansC.sbi (*)

alh, icm und png sind zzt. nicht mehr zu sehen und auch cinema plus ist weg. Kann aber auch am adblocker liegen.

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2014

Ran by Mimi (administrator) on STEPPO on 26-10-2014 15:07:32

Running from C:\Users\Mimi\Desktop\Security

Loaded Profile: Mimi (Available profiles: Stephan & Mimi)

Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe

() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe

() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9654.17044_x64__8wekyb3d8bbwe\glcnd.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7573208 2014-04-22] (Realtek Semiconductor)

HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe [3962936 2014-03-28] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [415288 2014-03-28] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [415288 2014-03-28] (Hewlett-Packard)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2811120 2014-03-13] (Synaptics Incorporated)

HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [126240 2014-02-13] (Hewlett-Packard Company)

HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [475448 2014-03-26] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-09-24] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

BootExecute: autocheck autochk * sdnclean64.exe
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPNOT14/4

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

SearchScopes: HKLM - {FE81BB90-6408-42D2-8133-29E869E8DC35} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{EFBDAE16-3547-4A0A-96FA-C59753428745}: [NameServer] 5.79.84.141,8.38.77.107
 

FireFox:

========

FF ProfilePath: C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default

FF Homepage: google.de

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
 

Chrome: 

=======
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-09-24] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-09-24] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)

S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2251992 2013-11-13] (Broadcom Corporation.)

R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-01-28] (WildTangent)

R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2014-01-13] (Hewlett-Packard Company) [File not signed]

R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [469304 2014-03-26] (Hewlett-Packard Development Company, L.P.)

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)

R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [200168 2013-12-04] ()

R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)

S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)

S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-05-07] (Microsoft Corporation)

R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [88064 2014-03-28] (Softex Inc.) [File not signed]

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-01-08] (Realtek Semiconductor)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)

S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)

R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [190704 2014-03-13] (Synaptics Incorporated)

S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-04-02] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-09-24] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-09-24] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-09-24] (Avira Operations GmbH & Co. KG)

R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-11-13] (Broadcom Corporation.)

R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7517872 2014-06-12] (Broadcom Corporation)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)

S3 BtwSerialBus; C:\Windows\System32\drivers\BtwSerialBus.sys [150744 2013-09-09] (Broadcom Corporation.)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91912 2013-11-12] (CyberLink)

R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [21408 2013-08-13] ()

R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [21920 2013-08-13] ()

R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [29088 2013-08-13] ()

R3 ISCT; C:\Windows\System32\drivers\ISCTD64.sys [46568 2013-08-13] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-26] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)

R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-11] (Intel Corporation)

R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [291544 2014-01-04] (Realtek Semiconductor Corp.)

U5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [466136 2014-01-14] (Realsil Semiconductor Corporation)

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2014-03-13] (Synaptics Incorporated)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-03-13] (Synaptics Incorporated)

R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-26 14:41 - 2014-10-26 15:07 - 00000000 ____D () C:\Users\Mimi\Desktop\Security

2014-10-26 12:05 - 2014-10-26 12:05 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safari.lnk

2014-10-26 12:05 - 2014-10-26 12:05 - 00000000 ____D () C:\Program Files (x86)\Safari

2014-10-26 11:59 - 2014-10-26 11:59 - 00929871 _____ () C:\Users\Mimi\Downloads\adblock_plus-2.6.5-an_tb_fx_sm.zip

2014-10-26 11:59 - 2014-10-21 12:13 - 00979610 _____ () C:\Users\Mimi\Downloads\adblock_plus-2.6.5-an+tb+fx+sm.xpi

2014-10-26 11:52 - 2014-10-26 11:52 - 00003836 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1414320714

2014-10-26 11:51 - 2014-10-26 11:51 - 00001158 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2014-10-26 11:50 - 2014-10-26 11:50 - 00001556 _____ () C:\Windows\IE11_main.log

2014-10-26 11:38 - 2014-10-26 11:38 - 00001182 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-10-26 11:38 - 2014-10-26 11:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-10-23 19:48 - 2014-10-23 19:48 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\00506449.sys

2014-10-23 17:05 - 2014-10-26 15:07 - 00000000 ____D () C:\FRST

2014-10-23 17:02 - 2014-10-23 17:02 - 00000000 _____ () C:\Users\Mimi\defogger_reenable

2014-10-23 16:31 - 2014-10-23 16:31 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\70474D78.sys

2014-10-21 22:53 - 2014-10-21 22:53 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Avira

2014-10-21 22:03 - 2013-08-22 14:25 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141021-230357.backup

2014-10-21 19:26 - 2014-10-21 19:26 - 00001414 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-10-21 19:26 - 2014-10-21 19:26 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-10-21 19:26 - 2014-10-21 19:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-10-21 19:25 - 2014-10-21 21:46 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-10-21 19:25 - 2014-10-21 19:41 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-10-21 19:25 - 2013-09-20 09:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2014-10-21 16:09 - 2014-10-21 16:09 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Avira

2014-10-21 16:06 - 2014-10-21 16:05 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-10-21 16:03 - 2014-09-24 11:44 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-10-21 16:03 - 2014-09-24 11:44 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-10-21 16:03 - 2014-09-24 11:44 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2014-10-21 15:44 - 2014-09-22 07:42 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-10-21 15:22 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll

2014-10-21 15:22 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll

2014-10-21 01:17 - 2014-10-21 01:17 - 00000000 _____ () C:\autoexec.bat

2014-10-21 01:13 - 2014-10-21 06:49 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP

2014-10-21 00:53 - 2014-10-21 00:53 - 00000000 ____D () C:\Synaptics

2014-10-21 00:22 - 2014-10-26 14:57 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-21 00:22 - 2014-10-21 00:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-21 00:21 - 2014-10-21 00:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-21 00:21 - 2014-10-21 00:21 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-10-21 00:21 - 2014-10-01 10:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-10-21 00:21 - 2014-10-01 10:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-10-21 00:21 - 2014-10-01 10:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-10-21 00:02 - 2014-10-21 00:07 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-10-20 22:51 - 2014-10-20 23:00 - 00132108 _____ () C:\Users\Mimi\Downloads\OTL.Txt

2014-10-20 22:51 - 2014-10-20 22:51 - 00071802 _____ () C:\Users\Mimi\Downloads\Extras.Txt

2014-10-20 22:22 - 2014-10-20 22:22 - 00000000 ____D () C:\Windows\ERUNT

2014-10-20 22:04 - 2014-10-26 14:54 - 00000000 ____D () C:\AdwCleaner

2014-10-16 20:10 - 2014-10-20 21:34 - 00002166 _____ () C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk

2014-10-16 20:10 - 2014-10-16 20:10 - 00002337 _____ () C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk

2014-10-16 12:26 - 2014-10-16 12:26 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Opera Software

2014-10-16 12:26 - 2014-10-16 12:26 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Opera Software

2014-10-15 05:31 - 2014-09-27 23:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-15 05:31 - 2014-09-04 01:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll

2014-10-15 05:31 - 2014-09-04 00:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll

2014-10-15 05:31 - 2014-09-04 00:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll

2014-10-15 05:30 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-10-15 05:30 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-10-15 05:29 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-10-15 05:29 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-10-15 05:29 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-10-15 05:29 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-10-15 05:29 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-10-15 05:29 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-10-15 05:29 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-10-15 05:29 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-10-15 05:29 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-10-15 05:29 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-10-15 05:29 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-10-15 05:29 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-10-15 05:29 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-10-15 05:29 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-10-15 05:29 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-10-15 05:29 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-10-15 05:29 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-10-15 05:29 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-10-15 05:29 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-10-15 05:29 - 2014-09-19 01:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-10-15 05:29 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-10-15 05:29 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-10-15 05:29 - 2014-09-19 01:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-10-15 05:29 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-10-15 05:29 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-10-15 05:29 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-10-15 05:29 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-10-15 05:29 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-10-15 05:28 - 2014-09-13 07:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-10-15 05:28 - 2014-09-13 06:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-10-15 05:28 - 2014-09-08 04:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-10-15 05:28 - 2014-09-08 02:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-10-15 05:28 - 2014-09-08 02:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-10-15 05:28 - 2014-09-08 01:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-10-15 05:28 - 2014-09-08 01:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-10-15 05:28 - 2014-09-08 01:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-10-15 05:28 - 2014-09-08 01:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2014-10-15 05:28 - 2014-09-08 01:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-10-15 05:28 - 2014-09-08 01:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-10-15 05:28 - 2014-09-08 01:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-10-15 05:28 - 2014-09-08 00:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-10-15 05:28 - 2014-09-08 00:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-10-15 05:28 - 2014-09-08 00:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-10-15 05:28 - 2014-09-08 00:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-10-15 05:27 - 2014-09-04 01:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll

2014-10-15 05:27 - 2014-09-04 01:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll

2014-10-15 05:27 - 2014-08-16 05:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-10-15 05:27 - 2014-08-16 05:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll

2014-10-15 05:27 - 2014-08-16 05:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2014-10-15 05:27 - 2014-08-16 04:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-10-15 05:27 - 2014-08-16 04:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-10-15 05:27 - 2014-08-16 04:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-10-15 05:27 - 2014-08-16 04:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-10-15 05:27 - 2014-08-16 04:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll

2014-10-15 05:27 - 2014-08-16 04:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2014-10-15 05:27 - 2014-08-16 02:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-10-15 05:27 - 2014-08-16 02:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll

2014-10-15 05:27 - 2014-08-16 01:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll

2014-10-15 05:27 - 2014-08-16 01:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll

2014-10-15 05:27 - 2014-08-16 01:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll

2014-10-15 05:27 - 2014-08-16 01:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll

2014-10-15 05:27 - 2014-08-16 01:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll

2014-10-15 05:27 - 2014-08-16 01:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll

2014-10-15 05:27 - 2014-08-16 01:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll

2014-10-15 05:27 - 2014-08-16 01:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll

2014-10-15 05:27 - 2014-08-16 01:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-15 05:27 - 2014-08-16 01:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll

2014-10-15 05:27 - 2014-08-16 01:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll

2014-10-15 05:27 - 2014-08-16 01:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll

2014-10-15 05:27 - 2014-08-16 01:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-15 05:27 - 2014-08-16 01:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll

2014-10-15 05:27 - 2014-08-16 01:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll

2014-10-15 05:27 - 2014-08-16 01:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll

2014-10-15 05:27 - 2014-08-16 01:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-15 05:27 - 2014-08-16 01:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll

2014-10-15 05:27 - 2014-08-16 01:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll

2014-10-15 05:27 - 2014-08-16 01:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll

2014-10-15 05:27 - 2014-08-16 01:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe

2014-10-15 05:27 - 2014-08-16 01:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-10-15 05:27 - 2014-08-16 01:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll

2014-10-15 05:27 - 2014-08-01 00:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml

2014-10-15 05:26 - 2014-10-09 23:16 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-10-15 05:26 - 2014-10-08 23:09 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-10-15 05:26 - 2014-09-19 02:24 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-10-15 05:26 - 2014-09-13 07:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-15 05:26 - 2014-09-13 06:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-10-15 05:26 - 2014-08-29 02:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll

2014-10-15 05:26 - 2014-08-29 00:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-10-15 05:26 - 2014-08-29 00:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-10-15 05:14 - 2014-10-15 05:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-10-15 05:11 - 2014-10-26 14:56 - 00001358 _____ () C:\Windows\Tasks\BHWWS.job

2014-10-15 05:11 - 2014-10-15 05:11 - 00004364 _____ () C:\Windows\System32\Tasks\BHWWS

2014-10-15 05:10 - 2014-10-26 14:56 - 00001708 _____ () C:\Windows\Tasks\DTTZBVQB.job

2014-10-15 05:10 - 2014-10-15 05:10 - 00004714 _____ () C:\Windows\System32\Tasks\DTTZBVQB

2014-10-09 21:19 - 2014-10-26 11:52 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Opera Software

2014-10-09 21:19 - 2014-10-26 11:52 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Opera Software

2014-10-09 21:19 - 2014-10-26 11:51 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-10-06 23:55 - 2014-10-06 23:55 - 00000000 ____D () C:\Users\Stephan\Documents\Avatar

2014-10-06 23:54 - 2014-10-06 23:54 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\CyberLink

2014-10-06 23:52 - 2014-10-06 23:52 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Apple Computer

2014-10-06 22:33 - 2014-10-21 16:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-10-06 22:32 - 2014-10-21 16:03 - 00000000 ____D () C:\ProgramData\Avira

2014-10-06 22:32 - 2014-10-21 16:03 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-10-06 15:59 - 2014-10-06 15:59 - 00000000 ____D () C:\Users\Mimi\Documents\web

2014-10-06 13:45 - 2014-10-06 13:45 - 00002522 _____ () C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

2014-10-06 04:58 - 2014-10-06 04:58 - 00000000 ____D () C:\Users\Mimi\AppData\Local\CrashDumps

2014-10-01 04:28 - 2014-10-15 05:39 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Apple Computer

2014-09-30 21:46 - 2014-10-26 12:09 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Apple Computer

2014-09-30 21:46 - 2014-10-26 12:06 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Apple Computer

2014-09-30 21:46 - 2014-09-30 21:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-09-30 21:44 - 2012-08-21 12:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys

2014-09-30 21:43 - 2014-09-30 21:44 - 00000000 ____D () C:\Program Files\iTunes

2014-09-30 21:43 - 2014-09-30 21:44 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-09-30 21:43 - 2014-09-30 21:43 - 00000000 ____D () C:\ProgramData\Apple Computer

2014-09-30 21:43 - 2014-09-30 21:43 - 00000000 ____D () C:\Program Files\iPod

2014-09-30 21:41 - 2014-09-30 21:41 - 00002535 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

2014-09-30 21:41 - 2014-09-30 21:41 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Apple

2014-09-30 21:41 - 2014-09-30 21:41 - 00000000 ____D () C:\Program Files\Common Files\Apple

2014-09-30 21:41 - 2014-09-30 21:41 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update

2014-09-28 10:14 - 2014-10-02 06:03 - 00000000 ____D () C:\Users\Stephan\Desktop\Flohmarkt1

2014-09-26 10:35 - 2014-09-26 10:36 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Mozilla

2014-09-26 10:35 - 2014-09-26 10:36 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Mozilla
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-26 15:02 - 2014-05-07 18:54 - 00800954 _____ () C:\Windows\system32\perfh007.dat

2014-10-26 15:02 - 2014-05-07 18:54 - 00174458 _____ () C:\Windows\system32\perfc007.dat

2014-10-26 15:02 - 2014-03-18 10:53 - 01921090 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-10-26 15:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru

2014-10-26 14:58 - 2014-09-19 11:03 - 00000000 ____D () C:\Users\Mimi\Documents\Youcam

2014-10-26 14:55 - 2014-03-18 10:44 - 00411316 _____ () C:\Windows\PFRO.log

2014-10-26 14:55 - 2013-08-22 15:46 - 00033460 _____ () C:\Windows\setupact.log

2014-10-26 14:55 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-26 14:35 - 2014-09-19 10:33 - 02001300 _____ () C:\Windows\WindowsUpdate.log

2014-10-26 12:49 - 2014-09-19 11:11 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2446055026-3567564273-3713566540-1004

2014-10-26 11:47 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF

2014-10-26 11:38 - 2014-09-23 21:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-10-26 11:15 - 2014-09-19 11:02 - 00000000 ____D () C:\Users\Mimi

2014-10-26 10:51 - 2014-09-19 11:17 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{EBD4C036-B3CB-4392-808C-89DA60C8B663}

2014-10-25 19:27 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache

2014-10-25 13:38 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI

2014-10-23 18:58 - 2014-09-19 10:41 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2446055026-3567564273-3713566540-1001

2014-10-23 17:31 - 2014-09-19 10:41 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9EEBF207-CFCB-43C0-B7A7-45B2F06D4561}

2014-10-23 16:34 - 2014-09-23 21:42 - 00000000 ____D () C:\Users\Mimi\Documents\Outlook-Dateien

2014-10-21 22:59 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness

2014-10-21 21:59 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp

2014-10-21 15:55 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\ELAMBKUP

2014-10-21 15:54 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM

2014-10-16 21:47 - 2014-09-19 11:02 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Packages

2014-10-16 17:13 - 2014-09-19 10:38 - 00000000 ____D () C:\Users\Stephan\Documents\Youcam

2014-10-16 17:10 - 2014-09-22 15:40 - 00002169 _____ () C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk

2014-10-16 12:33 - 2014-06-12 12:03 - 00000000 ____D () C:\ProgramData\McAfee

2014-10-16 12:33 - 2014-06-12 12:03 - 00000000 ____D () C:\Program Files (x86)\McAfee

2014-10-16 12:31 - 2014-05-07 09:41 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection

2014-10-16 12:20 - 2014-09-24 19:10 - 00000000 ___HD () C:\Users\Public\Temp

2014-10-16 12:17 - 2013-08-22 15:44 - 00492032 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-10-16 06:31 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData

2014-10-16 06:31 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\WinStore

2014-10-16 06:31 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\MediaViewer

2014-10-16 06:31 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\FileManager

2014-10-16 06:31 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Camera

2014-10-16 06:23 - 2014-09-20 15:03 - 00000000 ____D () C:\Users\Stephan\Documents\Outlook-Dateien

2014-10-15 06:09 - 2014-09-19 20:07 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-10-15 06:04 - 2014-09-21 00:18 - 00000000 ____D () C:\Windows\system32\MRT

2014-10-15 05:47 - 2014-09-21 00:18 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-10-15 05:45 - 2014-09-22 12:32 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-10-14 18:41 - 2014-06-12 11:39 - 00000000 ____D () C:\ProgramData\Package Cache

2014-10-12 18:05 - 2014-09-22 11:53 - 00000000 ____D () C:\Users\Stephan\Desktop\Rechnungen Möbeltaxi

2014-10-11 09:06 - 2014-09-19 10:35 - 00000000 ____D () C:\Users\Stephan

2014-10-09 22:17 - 2014-09-19 20:34 - 00000000 ____D () C:\beide

2014-10-06 23:54 - 2014-06-12 12:02 - 00000000 ____D () C:\Users\Public\CyberLink

2014-10-06 23:53 - 2014-09-19 10:38 - 00000000 ____D () C:\Users\Stephan\AppData\Local\CyberLink

2014-10-06 23:53 - 2014-06-12 11:51 - 00000000 ____D () C:\ProgramData\CyberLink

2014-10-06 23:53 - 2014-05-07 18:34 - 00000000 ___HD () C:\HP

2014-09-30 21:41 - 2014-06-12 11:43 - 00000000 ____D () C:\ProgramData\Apple

2014-09-29 23:45 - 2014-09-22 12:39 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-09-29 23:45 - 2014-09-22 12:39 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-09-26 18:37 - 2014-03-18 10:38 - 00000000 ____D () C:\Program Files\Windows Journal

2014-09-26 18:37 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel

2014-09-26 18:37 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2014-09-26 18:37 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2014-09-26 18:37 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\setup

2014-09-26 18:37 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\setup

2014-09-26 18:37 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\system32\oobe

2014-09-26 05:53 - 2014-09-24 05:41 - 00000000 ____D () C:\Users\Stephan\AppData\Local\CrashDumps
 

Some content of TEMP:

====================

C:\Users\Mimi\AppData\Local\Temp\avgnt.exe

C:\Users\Mimi\AppData\Local\Temp\Quarantine.exe

C:\Users\Mimi\AppData\Local\Temp\sqlite3.dll

C:\Users\Stephan\AppData\Local\Temp\AdhL1.exe

C:\Users\Stephan\AppData\Local\Temp\avgnt.exe

C:\Users\Stephan\AppData\Local\Temp\BackupSetup.exe

C:\Users\Stephan\AppData\Local\Temp\EdSD9.dll

C:\Users\Stephan\AppData\Local\Temp\EdSD9.exe

C:\Users\Stephan\AppData\Local\Temp\jzdp9.dll

C:\Users\Stephan\AppData\Local\Temp\jzdp9.exe

C:\Users\Stephan\AppData\Local\Temp\OnlineBackup.exe

C:\Users\Stephan\AppData\Local\Temp\setup_337.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-20 23:01
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Über Chip lädt man auch keine Software mehr....

Ich brauch bitte noch ne frische Addition.txt.

Aha, ich dachte chip wäre seriös. Wo läd man denn heute? Anbei die frische Addition

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-10-2014

Ran by Mimi at 2014-10-27 16:06:54

Running from C:\Users\Mimi\Desktop\Security

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.4.144 - Adobe Systems, Inc.)

Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)

Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)

Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 6.223.215.5 - Broadcom Corporation)

Broadcom Bluetooth Drivers (HKLM\...\{0A1B4690-E176-4533-8058-939480AEE1D0}) (Version: 12.0.0.9130 - Broadcom Corporation)

Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden

Building the Great Wall of China Collector's Edition (x32 Version: 3.0.2.48 - WildTangent) Hidden

Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.) Hidden

Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.) Hidden

Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.) Hidden

Crazy Chicken Soccer (x32 Version: 2.2.0.110 - WildTangent) Hidden

CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.6.3728 - CyberLink Corp.)

Cyberlink PhotoDirector (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.4.4824 - CyberLink Corp.)

CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.6.3821 - CyberLink Corp.)

CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.6.3604 - CyberLink Corp.)

CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3.3709 - CyberLink Corp.)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.3.3907 - CyberLink Corp.)

DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden

Energy Star (HKLM\...\{465CA2B6-98AF-4E77-BE22-A908C34BB9EC}) (Version: 1.0.9 - Hewlett-Packard Company)

Evernote v. 5.2 (HKLM-x32\...\{412F6426-A3C7-11E3-8A71-00163E98E7D6}) (Version: 5.2.0.2951 - Evernote Corp.)

Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden

Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

HP 3D DriveGuard (HKLM-x32\...\{F90A86C9-7779-47DD-AC06-8EE832C55F55}) (Version: 6.0.18.1 - Hewlett-Packard Company)

HP CoolSense (HKLM-x32\...\{E2C8D0C2-1C97-4C05-939A-5B13A0FE655C}) (Version: 2.20.31 - Hewlett-Packard Company)

HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden

HP Documentation (HKLM-x32\...\{082B1425-0F24-43FA-9B64-E8F617B0AD3B}) (Version: 1.1.0.0 - Hewlett-Packard)

HP Postscript Converter (Version: 4.5.12202 - Hewlett-Packard) Hidden

HP Recovery Manager (x32 Version: 1.16.1420 - Hewlett-Packard) Hidden

HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7493.4758 - Hewlett-Packard)

HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.11 - Hewlett-Packard)

HP SimplePass (Version: 8.01.11 - Hewlett-Packard) Hidden

HP Support Assistant (HKLM-x32\...\{8C696B4B-6AB1-44BC-9416-96EAC474CABE}) (Version: 7.5.2.12 - Hewlett-Packard Company)

HP System Event Utility (HKLM-x32\...\{DEF23826-DB71-4654-BC00-D5D6C20802EA}) (Version: 1.1.4 - Hewlett-Packard Company)

HP Utility Center (HKLM\...\{36F80C5F-DC0D-4DF4-AF09-DC1867F0EB0A}) (Version: 2.4.4 - Hewlett-Packard Company)

HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)

Inst5675 (Version: 8.01.11 - Softex Inc.) Hidden

Inst5676 (Version: 8.01.11 - Softex Inc.) Hidden

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3408 - Intel Corporation)

Intel(R) Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.0.0.1002 - Intel Corporation)

Intel(R) Smart Connect Technology (HKLM\...\{8B4EA042-9E21-46FB-8286-225F4D51CC52}) (Version: 4.2.41.2710 - Intel Corporation)

Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)

Intel(R) Trusted Execution Engine (Version: 1.1.1.1 - Intel Corporation) Hidden

Intel(R) Trusted Execution Engine Driver (Version: 1.0.0.1064 - Intel Corporation) Hidden

iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)

Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)

Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Mozilla Firefox 33.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0.1 (x86 de)) (Version: 33.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0.1 - Mozilla)

Opera Stable 25.0.1614.63 (HKLM-x32\...\Opera 25.0.1614.63) (Version: 25.0.1614.63 - Opera Software ASA)

Plants vs. Zombies - Game of the Year (x32 Version: 3.0.2.51 - WildTangent) Hidden

Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden

Ranch Rush 2 - Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.273.40 - Realtek Semiconductor Corp.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.24.1218.2013 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7231 - Realtek Semiconductor Corp.)

Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 18.1.5.2 - Synaptics Incorporated)

TeamViewer 9 Host (HKLM-x32\...\TeamViewer 9 Host) (Version: 9.0.32494 - TeamViewer)

Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden

Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden

Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden

Virtual Families (x32 Version: 2.2.0.98 - WildTangent) Hidden

Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden

WildTangent Games App für HP (x32 Version: 4.0.11.2 - WildTangent) Hidden

WildTangent-Spiele (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)

Youda Jewel Shop (x32 Version: 3.0.2.51 - WildTangent) Hidden
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

21-10-2014 00:14:05 Installed SpyHunter

26-10-2014 11:04:29 Installed Safari
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {03525191-2818-4456-888D-3A7192E2BACE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask

Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {17C72762-734C-4B70-AAC2-5D74CC2519EB} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe

Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {21199D4C-F9E7-4A63-8AFD-C469861365D8} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics

Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate

Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)

Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)

Task: {435A3907-8132-40E2-8BA5-142799C77218} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe

Task: {4757E115-2C2F-4AE2-BB63-860AD2712FC3} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv

Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance

Task: {537E8FD2-D489-4A80-B2AB-0050A0FBD196} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [2014-03-07] (CyberLink Corp.)

Task: {56BD98E5-BC44-41BC-81FE-3287F5B2237E} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload

Task: {57775F9D-AFB7-489B-B1FD-3FF1E8656E51} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [2013-11-01] (Hewlett-Packard Development Company, L.P.)

Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup

Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task

Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {7579AC14-35E3-4A2F-B87F-0F95DDE6DB2F} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-10-15] (Microsoft Corporation)

Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task

Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask

Task: {98292BAF-42C3-4FC1-9056-7EB1EE3B3C57} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation

Task: {9BF7FFD1-1970-4AB6-8C7C-3D1704385292} - System32\Tasks\DTTZBVQB => C:\Users\Stephan\AppData\Roaming\DTTZBVQB.exe <==== ATTENTION

Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work

Task: {A7D760E0-5FF2-4493-BE8A-D04147F5137C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)

Task: {C111F0E1-07DD-446E-B7CC-1FED8676AAF5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-12-18] (Hewlett-Packard)

Task: {CBDA51B5-18F3-4C3F-BBAD-09E7E42FDD0E} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-03-18] (Microsoft Corporation)

Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask

Task: {D352DA66-6B83-46D8-9915-8E7B856C5978} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management

Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization

Task: {E320C1A2-C49D-4B28-8CE2-B591B1D3CC3F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company)

Task: {E611AC48-C78A-49B8-BD92-2BBFD6609FCA} - System32\Tasks\BHWWS => C:\Users\Stephan\AppData\Roaming\BHWWS.exe <==== ATTENTION

Task: {E6BC8682-1BE0-47F6-8A8B-AB9F8FEC3788} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe

Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE

Task: {ED51613F-CB07-440E-A088-C345D864981A} - System32\Tasks\Opera scheduled Autoupdate 1414320714 => C:\Program Files (x86)\Opera\launcher.exe [2014-10-23] (Opera Software)

Task: {F0B98C9F-6959-4722-99E9-087B230FC7AF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-12-18] (Hewlett-Packard)

Task: C:\Windows\Tasks\BHWWS.job => C:\Users\Stephan\AppData\Roaming\BHWWS.exe <==== ATTENTION

Task: C:\Windows\Tasks\DTTZBVQB.job => C:\Users\Stephan\AppData\Roaming\DTTZBVQB.exe <==== ATTENTION
 

==================== Loaded Modules (whitelisted) =============
 

2014-03-28 12:31 - 2014-03-28 12:31 - 02110464 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll

2014-03-28 12:27 - 2014-03-28 12:27 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll

2014-03-28 12:27 - 2014-03-28 12:27 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll

2014-03-28 12:27 - 2014-03-28 12:27 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll

2014-03-28 12:48 - 2014-03-28 12:48 - 00367504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll

2014-03-28 12:48 - 2014-03-28 12:48 - 00712080 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll

2013-12-04 07:44 - 2013-12-04 07:44 - 00200168 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe

2013-12-04 07:44 - 2013-12-04 07:44 - 00054760 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll

2013-12-04 07:44 - 2013-12-04 07:44 - 00034792 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTNetMon.dll

2013-09-04 23:17 - 2013-09-04 23:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2014-03-28 12:36 - 2014-03-28 12:36 - 00065024 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

2014-10-26 11:51 - 2014-10-15 10:33 - 00499832 _____ () C:\Program Files (x86)\Opera\25.0.1614.50\opera_crashreporter.exe

2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-07-31 11:16 - 2014-07-31 11:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2014-10-21 19:25 - 2014-05-13 11:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2014-10-21 19:25 - 2014-05-13 11:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2014-10-21 19:25 - 2014-05-13 11:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

2014-10-21 19:25 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll

2014-10-21 19:25 - 2012-04-03 16:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2013-09-04 23:14 - 2013-09-04 23:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

2014-10-26 11:51 - 2014-10-15 10:33 - 00156792 _____ () C:\Program Files (x86)\Opera\25.0.1614.50\message_center_win8.dll

2014-10-26 11:51 - 2014-10-15 10:33 - 01310328 _____ () C:\Program Files (x86)\Opera\25.0.1614.50\libglesv2.dll

2014-10-26 11:51 - 2014-10-15 10:33 - 00219256 _____ () C:\Program Files (x86)\Opera\25.0.1614.50\libegl.dll

2014-10-26 11:51 - 2014-10-15 10:33 - 09218680 _____ () C:\Program Files (x86)\Opera\25.0.1614.50\pdf.dll

2014-10-26 11:51 - 2014-10-15 10:33 - 00991864 _____ () C:\Program Files (x86)\Opera\25.0.1614.50\ffmpegsumo.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-2446055026-3567564273-3713566540-500 - Administrator - Disabled)

Gast (S-1-5-21-2446055026-3567564273-3713566540-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2446055026-3567564273-3713566540-1003 - Limited - Enabled)

Mimi (S-1-5-21-2446055026-3567564273-3713566540-1004 - Administrator - Enabled) => C:\Users\Mimi

Stephan (S-1-5-21-2446055026-3567564273-3713566540-1001 - Administrator - Enabled) => C:\Users\Stephan
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (10/27/2014 03:51:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 88583719
 

Error: (10/27/2014 03:51:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 88583719
 

Error: (10/27/2014 03:51:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (10/26/2014 00:30:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 14922
 

Error: (10/26/2014 00:30:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 14922
 

Error: (10/26/2014 00:30:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (10/26/2014 00:29:47 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: Steppo)

Description: Das Paket „Microsoft.Reader_6.3.9654.17044_x64__8wekyb3d8bbwe+Microsoft.Reader“ wurde beendet, da das Anhalten zu lange dauerte.
 

Error: (10/26/2014 11:35:22 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 119672
 

Error: (10/26/2014 11:35:22 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 119672
 

Error: (10/26/2014 11:35:22 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 
 

System errors:

=============

Error: (10/26/2014 00:37:11 PM) (Source: ACPI) (EventID: 13) (User: )

Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 

Error: (10/26/2014 00:19:46 PM) (Source: ACPI) (EventID: 13) (User: )

Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 

Error: (10/26/2014 00:19:41 PM) (Source: ACPI) (EventID: 13) (User: )

Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 

Error: (10/26/2014 00:19:36 PM) (Source: ACPI) (EventID: 13) (User: )

Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 

Error: (10/26/2014 11:35:24 AM) (Source: ACPI) (EventID: 13) (User: )

Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 

Error: (10/26/2014 10:57:27 AM) (Source: EventLog) (EventID: 6008) (User: )

Description: Das System wurde zuvor am ‎26.‎10.‎2014 um 10:55:27 unerwartet heruntergefahren.
 

Error: (10/26/2014 10:48:02 AM) (Source: ACPI) (EventID: 13) (User: )

Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 

Error: (10/25/2014 07:21:30 PM) (Source: DCOM) (EventID: 10010) (User: Steppo)

Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 

Error: (10/25/2014 07:20:59 PM) (Source: DCOM) (EventID: 10010) (User: Steppo)

Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 

Error: (10/25/2014 01:38:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Intel(R) Smart Connect Technology Agent" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%109
 
 

Microsoft Office Sessions:

=========================

Error: (10/27/2014 03:51:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 88583719
 

Error: (10/27/2014 03:51:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 88583719
 

Error: (10/27/2014 03:51:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (10/26/2014 00:30:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 14922
 

Error: (10/26/2014 00:30:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 14922
 

Error: (10/26/2014 00:30:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (10/26/2014 00:29:47 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: Steppo)

Description: Microsoft.Reader_6.3.9654.17044_x64__8wekyb3d8bbwe+Microsoft.Reader
 

Error: (10/26/2014 11:35:22 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 119672
 

Error: (10/26/2014 11:35:22 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 119672
 

Error: (10/26/2014 11:35:22 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Pentium(R) CPU N3530 @ 2.16GHz

Percentage of memory in use: 50%

Total physical RAM: 3988.09 MB

Available physical RAM: 1984.48 MB

Total Pagefile: 4692.09 MB

Available Pagefile: 1999.73 MB

Total Virtual: 131072 MB

Available Virtual: 131071.84 MB
 

==================== Drives ================================
 

Drive c: (Windows) (Fixed) (Total:678.02 GB) (Free:573.96 GB) NTFS

Drive d: (RECOVERY) (Fixed) (Total:19.6 GB) (Free:1.9 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 698.6 GB) (Disk ID: 9AF1B1A5)
 

Partition: GPT Partition Type.
 

==================== End Of Log ============================

Code:

Der Suchlauf über die ausgewählten Dateien wird begonnen:
 

Beginne mit der Suche in 'C:\' <Windows>

C:\swapfile.sys

  [WARNUNG]   Die Datei konnte nicht geöffnet werden!

C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\cb28a990-316d-488c-ad50-248dd0f8de58-2.exe.vir

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn

C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\cb28a990-316d-488c-ad50-248dd0f8de58-5.exe.vir

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn

C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\CinPl-2.5cV14.10-bho64.dll.vir

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn

C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\CinPl-2.5cV14.10-codedownloader.exe.vir

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn

Beginne mit der Suche in 'D:\' <RECOVERY>
 

Beginne mit der Desinfektion:

C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\CinPl-2.5cV14.10-codedownloader.exe.vir

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5295750c.qua' verschoben!

C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\CinPl-2.5cV14.10-bho64.dll.vir

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4a025aa4.qua' verschoben!

C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\cb28a990-316d-488c-ad50-248dd0f8de58-5.exe.vir

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '18610046.qua' verschoben!

C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\cb28a990-316d-488c-ad50-248dd0f8de58-2.exe.vir

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7e564f85.qua' verschoben!

Code:

C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\1293297481.mxaddon.vir        JS/Toolbar.Crossrider.D evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\utils.exe.vir        Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\AdwCleaner\Quarantine\C\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\Extensions\3c8f3083-413b-4aa6-ad29-fb93d8982e80@gmail.com\extensionData\plugins\91.js.vir        JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\AdwCleaner\Quarantine\C\Users\Stephan\AppData\Local\Temp\VOPackage.exe.vir        Win32/VOPackage.AD evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\AdwCleaner\Quarantine\C\Users\Stephan\AppData\Roaming\Mozilla\Firefox\Profiles\nbpps1a8.default\Extensions\3c8f3083-413b-4aa6-ad29-fb93d8982e80@gmail.com\extensionData\plugins\91.js.vir        JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\AdwCleaner\Quarantine\C\Windows\score.exe.vir        Variante von Win32/Agent.WGA Trojaner        Gesäubert durch Löschen - in Quarantäne kopiert

C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir        Variante von Win64/Systweak.A evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\{6eaeb8af-e4d9-4df5-b9d7-815f2928cdf7}Gw64.sys.vir        Variante von Win64/BrowseFox.AU evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\beide\str\Programme\Application Updater\ApplicationUpdater.exe        Variante von Win32/Toolbar.Widgi.A evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\beide\str\Programme\Gemeinsame Dateien\Spigot\Search Settings\SearchSettings.exe        Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\beide\str\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll        Win32/Toolbar.Widgi evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\beide\str\Programme\pdfforge Toolbar\WidgiHelper.exe        Win32/Toolbar.Widgi evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\beide\str\Programme\pdfforge Toolbar\IE\4.3\pdfforgeToolbarIE.dll        Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\AdhL1.exe        Variante von Win32/Adware.AddLyrics.CL Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\ICReinstall_nstDA09.tmp        Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\nsc620.tmp        Variante von Win32/InstallCore.PL evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\nsp3BDD.tmp        Variante von Win32/InstallCore.PO evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\nsrEB05.tmp        Variante von Win32/InstallCore.PO evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\nstDA09.tmp        Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\6A80tmp\cloud_backup_setup.exe        Win32/MyPCBackup.A evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\6A82tmp\optimizerpro.exe        Mehrere Bedrohungen        Gesäubert durch Löschen - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\is-4234E.tmp\package_plushd_installer_multilang.exe        Win32/AdWare.EoRezo.AW Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\is-4234E.tmp\package_shoppinghelper_installer_multilang.exe        Win32/AdWare.EoRezo.AW Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\is-H8NDO.tmp\gentlemjmbot_img.exe        Win32/AdWare.EoRezo.AW Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\is45637729\127855424_stp\Generic_vo.exe        Win32/VOPackage.X evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\is45637729\165431062_stp\Generic_vo.exe        Win32/VOPackage.X evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\is45637729\165431349_stp\rcpsetup_adppi12_adppi12.exe        Win32/Systweak.D evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\is45637729\3647467_stp\Generic_vo.exe        Win32/VOPackage.X evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\is45637729\3647825_stp\rcpsetup_adppi12_adppi12.exe        Win32/Systweak.D evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\is667172802\0E5B3EE8_stp\rcpsetup_adppi12_adppi12.exe        Win32/Systweak.D evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

C:\Users\Stephan\AppData\Local\Temp\nsgA3A9.tmp\nsManeshWeb.dll        Win32/InstallMonetizer.BC evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert

Mit Revo alle Browser ausser IE runter, Reste raus, neu installieren.

Setze folgendermassen den Internet Explorer zurück:

Öffne den Internet Explorer und gehe zu Extras -> Internetoptionen.
Klicke in der Registerkarte Erweitert unter "Internet Explorer-Einstellungen zurücksetzen" auf Zurücksetzen...
Klicke im Dialogfeld "Internet Explorer-Einstellungen zurücksetzen" zum Bestätigen auf Zurücksetzen.

(Hier findest du die bebilderte Anleitung.)

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

? Was meinst du mit Reste raus & neu installieren? Revo hat nur Opera erkannt und lauter systemseitige Programme (HP, apple, adobe, microsoft visual etc.) die kann ich doch nicht einfach rauslöschen?

nein, ich rede nur von den Browsern. Wenn Du Opera mit Revo deinstallierst wird Revo auch anbieten die Reste zu entfernen von Opera, das sollst du machen :)

Hey Schrauber, habe das Laptop jetzt auf Werkseinstellung zurückgesetzt. Danke für den Support & happy WE