Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   compatibilitycheck (https://www.trojaner-board.de/162777-compatibilitycheck.html)

HartmutA 14.01.2015 17:38
compatibilitycheck
 
Hallo
Ich bin neu bei Euch habe mich gerade erst angemeldet und bin noch ein wenig unsicher auf Eurem BOARD !
Ich habe die selben Probleme wie Hier von anderen Mitgliedern beschrieben.
Starker Leistungsverlust des Rechners Töne/Werbung ohne geöfnetes Programm.
ImTask-Manager befindet sich mehrmals der Prozess compatibilitycheck.
Mir ist es gelungen Diese dort raus zu bekommen,nach Neustart Heute Morgen waren die Plagegeister auch am Start. im Moment hab ich Sie wieder raus Rechner läuft normal...


Aber nun bitte ich um Eure Hilfe.
Ein bei Euch empfohlenes Tool habe ich runtergeladen und hab meinen Rechner damit gescannt "Frst64exe"
Gruß Hartmut:twak:

deeprybka 14.01.2015 17:44
:hallo:

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...:abklatsch:
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
  • Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
  • Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
  • Poste die Logfiles direkt in Deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean :daumenhoc bekommst.



Los geht's:

Schritt 1
http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)




Lesestoff
Posten in CODE-Tags: So gehts...
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://deeprybka.trojaner-board.de/tdss/codetags.gif

HartmutA 14.01.2015 18:17
FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-01-2015 02
Ran by HARDY (administrator) on HARDY-PC-NEU on 14-01-2015 18:09:47
Running from C:\Users\HARDY\Download
Loaded Profile: HARDY (Available profiles: HARDY & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Copyright 2013 SAMSUNG) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
(Copyright 2013 SAMSUNG) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\002\yewimmxqbs64.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
() C:\Windows\Temp\db22.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Copyright 2013 SAMSUNG) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
(Blue Onion Software) C:\Program Files (x86)\Blue Onion Software\DeskDrive\DeskDrive.exe
(J3S GmbH) C:\Program Files (x86)\COMPUTER BILD Account-Alarm\COMPUTER BILD Account-Alarm.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDExtHost.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDAppHost.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDRuntimeHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
() C:\Program Files (x86)\MEDION\MEDION NAS TOOL\MEDION NAS TOOL.exe
() C:\Program Files (x86)\Memeo\AutoBackup\InstantBackup.exe
(VideoLAN) C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
(Enigma Software Group USA, LLC.) C:\Users\HARDY\AppData\Local\Temp\esg_uninstall.exe~
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Samsung Link] => C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe [607584 2014-12-16] (Copyright 2013 SAMSUNG)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2353880 2013-11-01] (Microsoft Corp.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Run: [DeskDriveStartup] => C:\Program Files (x86)\Blue Onion Software\DeskDrive\DeskDrive.exe [66048 2012-02-08] (Blue Onion Software)
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Run: [COMPUTER BILD Account-Alarm] => C:\Program Files (x86)\COMPUTER BILD Account-Alarm\COMPUTER BILD Account-Alarm.exe [2058752 2014-08-07] (J3S GmbH)
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Run: [Adobe Reader Synchronizer] => C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AdobeCollabSync.exe [761064 2014-12-03] (Adobe Systems Incorporated)
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk
ShortcutTarget: Install LastPass IE RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe (LastPass)
Startup: C:\Users\HARDY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\HARDY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\Software\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = hxxp://search.iminent.com/?appId=33B9FB3A-FE0B-4252-B1EB-C14C033D16B7
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\Software\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = hxxp://isearch.claro-search.com/?affID=114161&tt=120812_bandext_3312_1&babsrc=HP_iclro&mntrId=204c3cc00000000000008c89a5cac3ba
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
SearchScopes: HKLM -> DefaultScope {FC1429EF-FB24-41D6-B6F1-934AB5D18A47} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dvd_14_18_ff&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyD0C0A0CtA0B0AtA0C0CtDtN0D0Tzu0SzzyDtCtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyByBtB0FtDyBzy0AtGyDtCyD0DtG0Bzy0EyDtGyDyD0CyBtGtAyBzzzz0A0D0Bzzzz0AtD0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDzyyB0FtBtCtCtAtG0C0AyDtAtG0DyC0F0AtG0F0CtAyDtGtC0DyEtBtB0EtBtCyCyCyEzz2Q&cr=1790956217&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=fmtgl&chnl=fmtgl&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyD0C0A0CtA0B0AtA0C0CtDtN0D0Tzu0CtCzzyBtN1L2XzutBtFtCtFtDtFtAtDtC&cr=1943622432
SearchScopes: HKLM -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://url24.info/?id=5221g9001s1254&q={searchTerms}
SearchScopes: HKLM -> {FC1429EF-FB24-41D6-B6F1-934AB5D18A47} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dvd_14_18_ff&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyD0C0A0CtA0B0AtA0C0CtDtN0D0Tzu0SzzyDtCtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyByBtB0FtDyBzy0AtGyDtCyD0DtG0Bzy0EyDtGyDyD0CyBtGtAyBzzzz0A0D0Bzzzz0AtD0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDzyyB0FtBtCtCtAtG0C0AyDtAtG0DyC0F0AtG0F0CtAyDtGtC0DyEtBtB0EtBtCyCyCyEzz2Q&cr=1790956217&ir=
SearchScopes: HKLM-x32 -> DefaultScope {117D9D1C-D66C-4F16-9BF7-A5CD2AFA4378} URL =
SearchScopes: HKLM-x32 -> Backup.Old.DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=fmtgl&chnl=fmtgl&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyD0C0A0CtA0B0AtA0C0CtDtN0D0Tzu0CtCzzyBtN1L2XzutBtFtCtFtDtFtAtDtC&cr=1943622432
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> DefaultScope {FC1429EF-FB24-41D6-B6F1-934AB5D18A47} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dvd_14_18_ff&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyD0C0A0CtA0B0AtA0C0CtDtN0D0Tzu0SzzyDtCtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyByBtB0FtDyBzy0AtGyDtCyD0DtG0Bzy0EyDtGyDyD0CyBtGtAyBzzzz0A0D0Bzzzz0AtD0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDzyyB0FtBtCtCtAtG0C0AyDtAtG0DyC0F0AtG0F0CtAyDtGtC0DyEtBtB0EtBtCyCyCyEzz2Q&cr=1790956217&ir=
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> Backup.Old.DefaultScope {9C1561B1-7036-483F-AF30-0CB0BACFD918}
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> BrowserMngrDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss_Btisdt7&mntrId=204C0008CAE02B2A&affID=121565&tsp=5007
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> {117D9D1C-D66C-4F16-9BF7-A5CD2AFA4378} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3297265&CUI=UN12007792674437102&UM=2
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://url24.info/?id=5221g9001s1254&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> {8DEC8B34-5A1F-4669-9ECB-9C609CAABD6A} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=17391BE0-5DAC-48BF-BB0C-9BCF95B2886A&apn_sauid=6252CB25-F72B-499D-92EE-4C3AA5883B39
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> {9C1561B1-7036-483F-AF30-0CB0BACFD918} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=fmtgl&chnl=fmtgl&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyD0C0A0CtA0B0AtA0C0CtDtN0D0Tzu0CtCzzyBtN1L2XzutBtFtCtFtDtFtAtDtC&cr=1943622432
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> {D4B61AF7-5C04-4825-8B0C-B9D10059FC40} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=204c3cc00000000000000008cae02b2a&r=940
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> {FC1429EF-FB24-41D6-B6F1-934AB5D18A47} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dvd_14_18_ff&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyD0C0A0CtA0B0AtA0C0CtDtN0D0Tzu0SzzyDtCtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyByBtB0FtDyBzy0AtGyDtCyD0DtG0Bzy0EyDtGyDyD0CyBtGtAyBzzzz0A0D0Bzzzz0AtD0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDzyyB0FtBtCtCtAtG0C0AyDtAtG0DyC0F0AtG0F0CtAyDtGtC0DyEtBtB0EtBtCyCyCyEzz2Q&cr=1790956217&ir=
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: CBAbzockschutz.InitToolbarBHO -> {2e250b90-0e7a-42a3-9d65-e39f9f227fa4} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} ->  No File
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Funmoods Helper Object -> {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} ->  No File
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
Toolbar: HKLM-x32 - COMPUTERBILD-Abzockschutz - {353e2a48-6254-4bd3-88f4-3b51a0ca7870} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Funmoods Toolbar - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} -  No File
Toolbar: HKLM-x32 - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} -  No File
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
Toolbar: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {B07F54E6-0806-47DB-B5D8-398F240776F2} file:///E:/viewer/ORDcmViewCD.ocx
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406
FF DefaultSearchEngine: Bing
FF Homepage: www.startzentrale.de
FF Keyword.URL:
FF NetworkProxy: "ftp", "80.241.216.195"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "80.241.216.195"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "80.241.216.195"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "ssl", "80.241.216.195"
FF NetworkProxy: "ssl_port", 3128
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll No File
FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll (LastPass)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll No File
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass.dll (LastPass)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKU\.DEFAULT: samsung.com/SamsungLinkPCPlugin -> C:\Program Files\Samsung\Samsung Link\utils\npSamsungLinkPCPlugin.dll No File
FF Plugin HKU\S-1-5-21-2389243879-3189858854-901359939-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\HARDY\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll No File
FF user.js: detected! => C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\user.js
FF user.js: detected! => C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-2389243879-3189858854-901359939-1000\FireFox\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\aol-suche.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\BrowserDefender.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\chordie.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\delta.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\firefox-add-ons.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\idealode.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\podcastde.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\qrobeit.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\search_engine.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\webwebweb---by-easy-video-downloader.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\youtube-videosuche.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\youtube.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\zonealarm.xml
FF Extension: Facebook Translate - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\facebook-translate@oliver.schloebe.de [2014-04-06]
FF Extension: FRITZ!Box AddOn - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\fb_add_on@avm.de [2014-11-27]
FF Extension: LastPass - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\support@lastpass.com [2014-03-21]
FF Extension: YouTube Unblocker - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\youtubeunblocker@unblocker.yt [2015-01-14]
FF Extension: Evernote Web Clipper - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800} [2014-07-24]
FF Extension: Add to Amazon Wish List Button - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\amznUWL2@amazon.com.xpi [2014-07-24]
FF Extension: 1-Click Dailymotion Video Downloader - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\DailymotionVideoDownloader@PeterOlayev.com.xpi [2013-10-31]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\elemhidehelper@adblockplus.org.xpi [2012-10-11]
FF Extension: Facebook Privacy Watcher - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\fpw@informatik.tu-darmstadt.de.xpi [2014-10-08]
FF Extension: ProxTube - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\ich@maltegoetz.de.xpi [2014-09-11]
FF Extension: PAYBACK Internet Assistent fuer Firefox - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\toolbar-ff@payback.de.xpi [2014-11-20]
FF Extension: Youtube and more - Easy Video Downloader - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\vdpure@link64.xpi [2014-12-07]
FF Extension: YouTube Smart Pause - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\YouTubeSmartPause@jetpack.xpi [2013-09-11]
FF Extension: Facebook Phishing Protector - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{023e9ca0-63f3-47b1-bcb2-9badf9d9ef28}.xpi [2013-02-11]
FF Extension: ImTranslator - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2012-10-10]
FF Extension: Adblock Plus - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-10-10]
FF Extension: BetterPrivacy - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2013-08-23]
FF Extension: COMPUTERBILD-Abzockschutz - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{d49175b3-3fd8-43b8-b28e-da5d47f3c398}.xpi [2012-10-17]
FF Extension: {fdf74615-70a3-4ee2-8c01-83e275e40e39} - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{fdf74615-70a3-4ee2-8c01-83e275e40e39}.xpi [2013-10-30]
FF Extension: LastPass - C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-2389243879-3189858854-901359939-1000\FireFox\Extensions\support@lastpass.com [2013-11-07]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com [2015-01-13]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2015-01-13]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2015-01-13]
FF HKLM-x32\...\Firefox\Extensions: [webbooster@iminent.com] - C:\Program Files (x86)\Iminent\webbooster@iminent.com
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Security Suite CBE 12\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Ngăn chặn trang web nguy hiểm - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-08-30]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Bàn phím ảo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-30]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Công cụ kiểm tra liên kết của Kaspersky - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-08-30]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-08-30]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: An toàn giao dịch tài chính - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-08-30]
FF HKU\.DEFAULT\...\Firefox\Extensions: [{b64982b1-d112-42b5-b1e4-d3867c4533f8}] - C:\ProgramData\Browser Manager\2.2.643.41\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension
FF HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\extensions\cliqz@cliqz.com

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [bbjciahceamgodcoidkjpchnokgfpphh] - C:\Users\HARDY\AppData\Local\funmoods.crx [2012-07-05]
CHR HKLM\...\Chrome\Extension: [cjpglkicenollcignonpgiafdgfeehoj] - C:\Users\HARDY\AppData\Local\funmoods-speeddial.crx [2012-07-05]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Chrome\Extension: [bbjciahceamgodcoidkjpchnokgfpphh] - C:\Users\HARDY\AppData\Local\funmoods.crx [2012-07-05]
CHR HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Chrome\Extension: [cjpglkicenollcignonpgiafdgfeehoj] - C:\Users\HARDY\AppData\Local\funmoods-speeddial.crx [2012-07-05]
CHR HKLM-x32\...\Chrome\Extension: [bbjciahceamgodcoidkjpchnokgfpphh] - C:\Users\HARDY\AppData\Local\funmoods.crx [2012-07-05]
CHR HKLM-x32\...\Chrome\Extension: [cjpglkicenollcignonpgiafdgfeehoj] - C:\Users\HARDY\AppData\Local\funmoods-speeddial.crx [2012-07-05]
CHR HKLM-x32\...\Chrome\Extension: [clbfjfbnelcflpgpklppgplejolacbej] - C:\Program Files (x86)\BrowserCompanion\blabbers-ch.crx [2011-12-22]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-17] (Adobe Systems Incorporated)
S4 AllShare Framework DMS; C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe [404360 2013-12-21] (Samsung) [File not signed]
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3645432 2014-07-18] (devolo AG)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link.exe [616288 2014-12-16] (Copyright 2013 SAMSUNG)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2143072 2012-05-29] (TuneUp Software)
S3 x10nets; C:\Program Files (x86)\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed]
R2 yewimmxqbs64; C:\Program Files\002\yewimmxqbs64.exe [706560 2014-05-28] () [File not signed]
S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
S2 Verifies and fixes application compatibility issues; C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe [X]
S2 ZAPrivacyService; "C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AF9035BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [513600 2009-11-05] (ITETech                  )
R3 azvusb; C:\Windows\System32\DRIVERS\azvusb.sys [54784 2009-08-13] (AzureWave Technologies, Inc.)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-07-18] () [File not signed]
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-08] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-08] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 L6UX2; C:\Windows\System32\Drivers\L6UX264.sys [772864 2013-07-11] (Line 6)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2014-07-18] (CACE Technologies)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-05-08] (TuneUp Software)
S3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [33048 2006-11-30] (X10 Wireless Technology, Inc.)
S3 ysusb64; C:\Windows\System32\drivers\ysusb64.sys [132200 2013-12-17] (Yamaha Corporation)
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-14 16:51 - 2015-01-14 18:10 - 00000000 ____D () C:\FRST
2015-01-14 16:50 - 2015-01-14 16:51 - 02124288 _____ (Farbar) C:\Users\HARDY\Desktop\FRST64.exe
2015-01-14 15:36 - 2015-01-14 15:36 - 00000000 ____D () C:\Users\HARDY\AppData\Local\{3E2B750B-A5D6-4D2D-A0E9-96A237D2BB4C}
2015-01-14 14:56 - 2015-01-14 14:56 - 00000389 _____ () C:\Users\HARDY\Desktop\Lexar (G) - 58,5GB (27,9).lnk
2015-01-14 13:29 - 2015-01-14 13:29 - 00001194 _____ () C:\Users\HARDY\Desktop\Boot (C).lnk
2015-01-14 09:35 - 2015-01-14 09:35 - 00000000 _____ () C:\Windows\SysWOW64\sho4FD4.tmp
2015-01-13 19:11 - 2015-01-13 19:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-13 06:30 - 2015-01-13 06:30 - 00000000 _____ () C:\autoexec.bat
2015-01-13 06:29 - 2015-01-14 16:17 - 00000000 ____D () C:\Users\HARDY\AppData\Roaming\Enigma Software Group
2015-01-13 06:29 - 2015-01-14 16:17 - 00000000 ____D () C:\sh4ldr
2015-01-13 06:08 - 2015-01-13 06:08 - 00003026 _____ () C:\Windows\System32\Tasks\{505E1B58-5E96-4D62-BF85-AA982B1E160F}
2015-01-13 06:07 - 2015-01-13 06:07 - 00003026 _____ () C:\Windows\System32\Tasks\{3C9A141B-419D-4002-A2CA-2159148DB79E}
2015-01-13 06:07 - 2015-01-13 06:07 - 00003026 _____ () C:\Windows\System32\Tasks\{20982DC0-A7D6-4D10-B57C-E7F4DAD29F14}
2015-01-10 08:09 - 2015-01-14 15:05 - 00000000 ____D () C:\Users\HARDY\AppData\Roaming\Compatibility Verifier
2015-01-10 08:04 - 2015-01-10 08:04 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-01-10 08:04 - 2015-01-10 08:04 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Adobe
2015-01-10 08:04 - 2015-01-10 08:04 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-01-10 08:04 - 2015-01-10 08:04 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Adobe
2015-01-10 08:02 - 2015-01-14 09:35 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Compatibility Verifier
2015-01-10 08:02 - 2015-01-14 09:35 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Compatibility Verifier
2015-01-09 21:19 - 2015-01-09 21:19 - 00000000 _____ () C:\Windows\SysWOW64\sho984B.tmp
2015-01-08 21:01 - 2015-01-08 21:01 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat
2015-01-07 19:50 - 2015-01-07 19:50 - 00000000 _____ () C:\Windows\SysWOW64\sho2C49.tmp
2015-01-07 14:28 - 2015-01-07 14:28 - 00000000 ____D () C:\Users\HARDY\AppData\Local\{E785105F-8D4F-44D8-AAAB-6FF163BCC985}
2015-01-03 11:32 - 2015-01-03 11:32 - 00000857 _____ () C:\Users\HARDY\Desktop\Guitar Explorer.lnk
2014-12-26 09:56 - 2014-12-26 09:56 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2014-12-20 06:54 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-20 06:54 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-16 17:56 - 2014-12-16 17:56 - 00000000 _____ () C:\Windows\SysWOW64\shoFFDC.tmp
2014-12-15 12:24 - 2014-12-15 12:24 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-15 09:05 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-15 09:05 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-15 09:05 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-15 09:05 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-15 09:05 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-15 09:05 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-15 09:05 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-15 09:05 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-15 09:05 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-15 09:05 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-15 09:05 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-15 09:05 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-15 09:05 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-15 09:05 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-15 09:05 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-15 09:05 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-15 09:05 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-15 09:05 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-12-15 09:05 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-12-15 09:05 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-12-15 09:05 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-12-15 09:05 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2014-12-15 09:05 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2014-12-15 09:05 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2014-12-15 09:05 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2014-12-15 09:04 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-15 09:04 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-15 09:04 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-15 09:04 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-15 09:04 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-15 09:04 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-15 09:04 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-15 09:04 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-15 09:04 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-15 09:04 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-15 09:04 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-15 09:04 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-15 09:04 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-15 09:04 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-15 09:04 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-15 09:04 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-15 09:04 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-15 09:04 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-15 09:04 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-15 09:04 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-15 09:04 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-15 09:04 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-15 09:04 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-15 09:04 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-15 09:04 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-15 09:04 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-15 09:04 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-15 09:04 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-15 09:04 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-15 09:04 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-15 09:04 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-15 09:04 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-15 09:04 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-15 09:04 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-15 09:04 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-15 09:04 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-15 09:04 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-15 09:04 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-15 09:04 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-15 09:04 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-15 09:04 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-15 09:04 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-15 09:04 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-15 09:04 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-15 09:04 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-15 09:04 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-15 09:04 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-15 09:04 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-15 09:04 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-15 09:04 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-15 09:04 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-15 09:04 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-15 09:04 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-15 09:04 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-14 18:09 - 2013-02-20 09:38 - 00000000 ____D () C:\Users\HARDY\Download
2015-01-14 17:50 - 2012-09-18 11:55 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-14 17:50 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-01-14 17:48 - 2014-10-15 09:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-14 15:33 - 2013-11-22 11:13 - 00000000 ____D () C:\Users\HARDY\MEDION NAS TOOL
2015-01-14 15:01 - 2011-05-16 15:04 - 00700612 _____ () C:\Windows\system32\perfh007.dat
2015-01-14 15:01 - 2011-05-16 15:04 - 00150494 _____ () C:\Windows\system32\perfc007.dat
2015-01-14 15:01 - 2009-07-14 06:13 - 01624592 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-14 14:48 - 2014-10-15 09:49 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-14 14:48 - 2013-07-16 18:38 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-14 14:48 - 2013-03-07 16:44 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-14 13:55 - 2014-12-03 07:39 - 00000112 _____ () C:\ProgramData\YO1gG4Aky.dat
2015-01-14 13:38 - 2014-03-02 04:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-14 13:38 - 2009-07-14 05:45 - 00024800 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-14 13:38 - 2009-07-14 05:45 - 00024800 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-14 13:34 - 2012-06-20 19:39 - 02071455 _____ () C:\Windows\WindowsUpdate.log
2015-01-14 13:29 - 2014-11-25 09:37 - 00000441 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-01-14 13:28 - 2014-07-01 07:04 - 00061191 _____ () C:\Windows\setupact.log
2015-01-14 13:28 - 2013-03-06 16:24 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-01-14 13:28 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-14 13:27 - 2009-07-14 05:45 - 00384816 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-13 06:08 - 2014-12-03 07:37 - 00000227 _____ () C:\Windows\SysWOW64\debug.log
2015-01-13 05:59 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-01-12 14:44 - 2014-07-18 08:55 - 00000000 ____D () C:\Users\HARDY\AppData\Roaming\AllDup
2015-01-12 14:43 - 2014-07-18 08:55 - 00000000 ____D () C:\ProgramData\AllDup
2015-01-12 14:17 - 2014-03-03 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Genius Professional Edition
2015-01-12 11:42 - 2014-11-24 14:12 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-12 11:42 - 2014-01-27 12:54 - 00000000 ____D () C:\Users\HARDY\AppData\Roaming\vlc
2015-01-12 11:42 - 2013-10-06 07:08 - 00000000 ____D () C:\Users\Gast
2015-01-12 11:42 - 2012-06-20 11:52 - 00000000 ___RD () C:\Users\HARDY
2015-01-12 11:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2015-01-12 11:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-01-09 21:19 - 2014-09-16 21:46 - 00032768 _____ () C:\Windows\system32\persistent_q.db-shm
2015-01-07 14:40 - 2012-06-21 08:39 - 00000000 ____D () C:\Users\HARDY\AppData\Roaming\MediaMonkey
2015-01-05 19:12 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-03 11:32 - 2014-09-14 13:52 - 00000857 _____ () C:\Users\Gast\Desktop\Guitar Explorer.lnk
2014-12-27 11:17 - 2014-03-03 18:30 - 00000000 ____D () C:\Users\HARDY\Documents\DriverGenius
2014-12-27 11:16 - 2013-09-20 15:42 - 00000000 ___RD () C:\Users\HARDY\Desktop\GITARREN-PROG
2014-12-24 09:32 - 2012-06-21 16:36 - 00000000 ____D () C:\Users\HARDY\AppData\Roaming\SoftGrid Client
2014-12-18 09:50 - 2014-05-24 08:39 - 00000000 ____D () C:\Users\HARDY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Samsung
2014-12-18 09:50 - 2012-06-23 12:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2014-12-16 09:31 - 2012-11-11 12:11 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-15 17:16 - 2014-11-25 07:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\mySongBook Player
2014-12-15 17:16 - 2014-11-25 07:36 - 00000000 ____D () C:\Program Files (x86)\mySongBook Player
2014-12-15 13:50 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-15 12:24 - 2014-04-24 12:35 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-15 12:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-15 09:15 - 2013-08-15 09:20 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-15 09:06 - 2011-07-18 21:31 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-15 08:59 - 2012-06-21 11:19 - 00000000 ____D () C:\Users\HARDY\AppData\Local\Adobe

Files to move or delete:
====================
C:\ProgramData\YO1gG4Aky.dat


Some content of TEMP:
====================
C:\Users\HARDY\AppData\Local\Temp\EsgInstallerx64Stub.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-26 13:10

==================== End Of Log ============================
--- --- ---

--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-01-2015 02
Ran by HARDY at 2015-01-14 18:11:32
Running from C:\Users\HARDY\Download
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

120GuitarChords (HKLM-x32\...\120GuitarChords) (Version:  - NeonWay)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
AC3Filter 2.6.0b (HKLM-x32\...\AC3Filter_is1) (Version: 2.6.0b - Alexander Vigovsky)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Photoshop Elements 11 (HKLM-x32\...\Adobe Photoshop Elements 11) (Version: 11.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 8.0 (HKLM-x32\...\Adobe Photoshop Elements 8.0) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5.3 64-bit (HKLM\...\{2DD71ACB-552D-402C-9529-7906ACB95C30}) (Version: 5.3.1 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
AllDup 3.4.24 (HKLM-x32\...\AllDup_is1) (Version: 3.4.24 - Michael Thummerer Software Design)
AllShare Framework DMS (HKLM\...\{83232C27-8C3F-44A5-9EB2-BB7161228ADD}) (Version: 1.3.23 - Samsung)
Amazon Cloud Player (HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Amazon Amazon Cloud Player) (Version: 2.4.0.26 - Amazon Services LLC)
Anleitung für Epson Connect (HKLM-x32\...\Epson Connect Guide) (Version:  - )
AntiBrowserSpy (HKLM-x32\...\{F78B5B4F-075A-4C81-AA27-E707861EB5B7}_is1) (Version: 3.6.108 - Abelssoft)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.12.9.0 - Asmedia Technology)
Audacity 2.0.2 (HKLM-x32\...\Audacity_is1) (Version: 2.0.2 - Audacity Team)
AVM FRITZ!Box Dokumentation (HKLM-x32\...\AVMFBox) (Version:  - AVM Berlin)
AVM FRITZ!Box Druckeranschluss (HKLM-x32\...\AVMFBoxPrinter) (Version:  - AVM Berlin)
Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.347.0 - Microsoft Corporation)
Cinergy HTC Stick V5.09.1202.00 (HKLM-x32\...\Cinergy HTC Stick) (Version: 5.09.1202.00 - )
COMPUTER BILD Account-Alarm (HKLM-x32\...\{04B0A9F1-070A-4C32-A575-6D2DC8F5C52E}) (Version: 1.0.3 - J3S)
COMPUTERBILD-Abzockschutz (HKLM-x32\...\{8AA87888-D4A2-4CA2-BAEC-7759D0AD8E38}) (Version: 1.0.43 - J3S)
Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
Covermanager (HKLM-x32\...\Covermanager_is1) (Version: 1.5.0 - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Das große Franzis Paket Office - Office Vorlagen Teil 1 (HKLM-x32\...\Das große Franzis Paket Office - Office Vorlagen Teil 1_is1) (Version:  - )
DeskDrive Version 1.8.5 (HKLM-x32\...\{840CAC48-BDE6-490C-AA34-904E10AB1261}_is1) (Version: 1.8.5 - Blue Onion Software)
devolo Cockpit (HKLM-x32\...\dlancockpit) (Version: 4.2.3.0 - devolo AG)
DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
dLAN Cockpit (x32 Version: 3.2.28 - devolo AG) Hidden
Driver Genius Professional Edition (HKLM-x32\...\Driver Genius Professional Edition_is1) (Version:  - Driver-Soft Inc.)
Dropbox (HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
DVDFab Version 8.0.2.2 (HKLM-x32\...\{616FEB8D-CA05-49F4-A155-B74F8DB38B7A}_is1) (Version: 8.0.2.2 - DVDFab 8.0.2.2 Preactivado - Dimitry)
Elements 11 Organizer (x32 Version: 11.0 - Ihr Firmenname) Hidden
Epson Benutzerhandbuch XP-600 Series (HKLM-x32\...\XP-600 Series Useg) (Version:  - )
Epson Easy Photo Print 2 (HKLM-x32\...\{02A312B5-1542-47B6-BFE9-F51358C39E86}) (Version: 2.4.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Netzwerkhandbuch XP-600 Series (HKLM-x32\...\XP-600 Series Netg) (Version:  - )
Epson Print CD (HKLM-x32\...\{D16A31F9-276D-4968-A753-FFEAC56995D0}) (Version: 2.20.00 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON XP-600 Series Printer Uninstall (HKLM\...\EPSON XP-600 Series) (Version:  - SEIKO EPSON Corporation)
Evernote v. 5.6.4 (HKLM-x32\...\{DFDF0BE2-2D71-11E4-9454-00163E98E7D6}) (Version: 5.6.4.4632 - Evernote Corp.)
Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych (HKLM-x32\...\{B04A0E2F-1E4C-4E61-B18E-3B2BD6779CA7}) (Version: 15.4.5722.2 - Microsoft Corporation)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Gitarrero Leadstar 1.00 Demo (HKLM-x32\...\Gitarrero Leadstar Maxi Demo_is1) (Version: 1.00 - Baumgaertel/ Wetzel)
Gitarrero Notenmeister (HKLM-x32\...\Gitarrero Notenmeister) (Version:  - )
Guitar Explorer 1.0 (HKLM-x32\...\Guitar Explorer 1.0) (Version:  - )
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2669 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Java 7 Update 9 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417009FF}) (Version: 7.0.90 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
K-Lite Codec Pack 6.0.4 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 6.0.4 - )
LastPass (uninstall only) (HKLM-x32\...\LastPass) (Version:  - LastPass)
Lidl-Fotos (HKLM-x32\...\Lidl-Fotos_is1) (Version:  - )
Liederalbum Paulchen 1.0 (HKLM-x32\...\Liederalbum Paulchen_is1) (Version: 1.0 - Gitarrero Software GbR)
Line 6 Uninstaller (HKLM-x32\...\Line 6 Uninstaller) (Version:  - Line 6)
M-DVD.Org V2 (HKLM-x32\...\{D831211C-EE0F-43E3-9F8C-E4832B34C18A}_is1) (Version: 2.0 - SynApp GmbH)
MediaMonkey 4.0 (HKLM-x32\...\MediaMonkey_is1) (Version: 4.0 - Ventis Media Inc.)
MediaShow 3.0 (HKLM-x32\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version:  - )
MEDION GoPal Assistant (HKLM-x32\...\{B9D45A76-61DF-4387-B0FE-CA165D582B57}) (Version: 6.3.6.13143 - MEDION)
MEDION NAS TOOL (HKLM-x32\...\MEDION NAS TOOL) (Version:  - MEDION)
Memeo Instant Backup (HKLM-x32\...\{8E666407-AC41-46a2-9692-6C7BFCBFDD37}) (Version: 4.60.0.7939 - Memeo Inc.)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{402ED4A1-8F5B-387A-8688-997ABF58B8F2}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft_VC100_CRT_x86 (HKLM-x32\...\{6FDDB201-2CA0-42BD-973F-7B2C4A61EA3F}) (Version: 1.0.0 - Microsoft)
Mozilla Firefox 35.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 de)) (Version: 35.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\MyFreeCodec) (Version:  - )
mySongBook Player (HKLM-x32\...\{42F6B687-F7B1-41A8-87CB-043FBBE4621D}_is1) (Version:  - Arobas Music)
Native Instruments DrumMicA (HKLM-x32\...\Native Instruments DrumMicA) (Version:  - Native Instruments)
Native Instruments Kontakt 5 (HKLM-x32\...\Native Instruments Kontakt 5) (Version: 5.4.2.245 - Native Instruments)
Native Instruments Service Center (HKLM-x32\...\Native Instruments Service Center) (Version: 2.4.1.1158 - Native Instruments)
Nero OEM (HKLM-x32\...\Nero - Burning Rom!UninstallKey) (Version:  - )
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
OpenOffice 4.1.0 Language Pack (German) (HKLM-x32\...\{ED7A9584-1F78-4CB0-B3E7-C30E6B7B02FE}) (Version: 4.10.9764 - Apache Software Foundation)
PhotoNow! 1.0 (HKLM-x32\...\{D36DD326-7280-11D8-97C8-000129760CBE}) (Version:  - )
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
PowerCinema 4.0 (HKLM-x32\...\{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version:  - )
PowerDirector (HKLM-x32\...\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version:  - )
PowerDVD (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version:  - )
PowerProducer (HKLM-x32\...\{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version:  - )
PSE11 STI Installer (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
RealSpeak Solo fur Deutsch - Steffi (HKLM-x32\...\{BFBB91DB-9F0F-4A9C-9669-A97DA3512CF2}) (Version: 4.00.0000 - ScanSoft)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6554 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.28.1 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.28.1 - Renesas Electronics Corporation) Hidden
RiffWorks T4 (HKLM-x32\...\RiffWorks T4) (Version: 2.6.7 - Sonoma Wire Works)
Samsung AllShare (HKLM-x32\...\InstallShield_{DF47ACA3-7C78-4C08-8007-AC682563C9F1}) (Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.)
Samsung AllShare (x32 Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.) Hidden
Samsung Link 2.0.0.1412161531 (HKLM\...\8474-7877-9059-0204) (Version: 2.0.0.1412161531 - Copyright 2013 SAMSUNG)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)
Software Updater (HKLM-x32\...\{82DEE0F4-18DB-4C49-89A4-0BEE4597DF45}) (Version: 4.1.5 - SEIKO EPSON CORPORATION)
SpyHunter 4 (HKLM-x32\...\SpyHunter) (Version: 4.18.9.4384 - Enigma Software Group, LLC)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
SynthFont (HKLM-x32\...\SynthFont) (Version:  - )
TuneUp Utilities 2012 (HKLM-x32\...\TuneUp Utilities 2012) (Version: 12.0.3600.73 - TuneUp Software)
TuneUp Utilities 2012 (x32 Version: 12.0.3600.73 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.3600.73 - TuneUp Software) Hidden
Turbo Lister 2 (HKLM-x32\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.)
TuxGuitar 1.2 (HKLM-x32\...\TuxGuitar_0) (Version:  - )
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Mobile Device Center Driver Update (HKLM\...\{92DBCA36-9B41-4DD1-941A-AED149DD37F0}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
X10 Hardware(TM) (HKLM-x32\...\X10Hardware) (Version:  - )
Yamaha Steinberg USB Driver (HKLM-x32\...\InstallShield_{B590D7D4-CB5C-4919-971F-EC5EA982749D}) (Version: 1.8.4 - Yamaha Corporation)
Yamaha Steinberg USB Driver (Version: 1.8.4 - Yamaha Corporation) Hidden
YAMAHA THR Editor (HKLM-x32\...\{5115B75F-32BF-42CB-A8BC-2F0A71C4DF93}) (Version: 1.0.0 - Yamaha Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

12-01-2015 11:35:27 Wiederherstellungsvorgang
12-01-2015 11:46:05 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
13-01-2015 05:48:40 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
14-01-2015 09:09:56 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
14-01-2015 09:14:41 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
14-01-2015 13:31:22 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2012-06-22 08:23 - 00000895 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.google-analytics.com
127.0.0.1 google-analytics.com


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01CE3279-476C-4C5C-89E7-001A26E6B6E7} - System32\Tasks\{5BB6C394-6524-4F8B-A640-24C0C0EE135F} => pcalua.exe -a "C:\Program Files (x86)\MEDION GoPal Assistant\GoPal_Assistant.exe" -d "C:\Program Files (x86)\MEDION GoPal Assistant\"
Task: {06AABA14-7105-4EB2-BC8E-EE398ECAFB3A} - System32\Tasks\{88878B95-990B-4979-A309-6C22ADC9F564} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {07587E55-8173-4B0E-8466-B374FECC9A17} - System32\Tasks\Google Updater and Installer => C:\Users\HARDY\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {0E23132F-78C4-477F-BEC4-536D9230D3B8} - System32\Tasks\{FAAA3501-6F34-4738-B3EF-0463B08318A3} => pcalua.exe -a "C:\Program Files (x86)\UX Pack\uxuninst.exe"
Task: {1ED94247-E3C5-4CB4-A2C2-06D4E1FEA2EE} - System32\Tasks\{D9991832-5ADC-43C4-96E1-9A329B31AFC7} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {2176B983-DB3D-4B0D-ABFF-80C9E1818476} - System32\Tasks\{FE96BCB8-1055-4C80-A4B6-29977CEA30A8} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {271F7165-0A28-4336-A546-9BF1EDB7A573} - System32\Tasks\{2F04B778-7291-4D46-83C6-A0202F0774C8} => C:\Program Files (x86)\EvilLyrics\EvilLyrics.exe <==== ATTENTION
Task: {28A4A412-0271-4D91-803F-73536605C94F} - System32\Tasks\{9AE069F7-D45D-4AEB-AB11-8ADDF4741DC4} => pcalua.exe -a "C:\Program Files (x86)\watchmi\Tvd.Setup.HotfixCheck.exe" -d "C:\Program Files (x86)\watchmi"
Task: {2D58DAAB-3FC7-4E5E-8CBB-529B05FB0A2D} - System32\Tasks\{759734EE-496E-437D-8746-432732041486} => C:\Program Files (x86)\M-DVD.Org V2\M-DVD_Org.exe [2005-10-28] (SynApp GmbH)
Task: {36A849B5-E844-4A06-841B-002CC0D82026} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)
Task: {3DE9985D-06A9-47A9-BE05-600ED4218B83} - System32\Tasks\{E6EF038A-821D-4B61-9E42-5868F795AEB4} => pcalua.exe -a C:\Users\HARDY\Download\aolsync-outlook-plugin.exe -d C:\Users\HARDY\Download
Task: {3E7E3EED-5133-4F23-88DF-930349022346} - System32\Tasks\{FAA6E2C1-F82F-4731-9EE8-563DDCE51AAB} => pcalua.exe -a C:\Users\HARDY\Downloads\M2Tech_USB_Audio_Driver_r1.5.exe -d C:\Users\HARDY\Downloads
Task: {3FB73559-1448-45B9-90D1-CA0B79693468} - System32\Tasks\{F0151E50-0B1B-43C4-917C-AEDB54C2FEFE} => msiexec.exe /package "C:\Users\HARDY\Downloads\Adobe Photoshop Elements 10\PSE 10\Adobe Photoshop Elements 10.msi"
Task: {45E79AE0-A4D8-4CBF-9FDA-2389593A8B9B} - System32\Tasks\{B8FD48E8-898D-4018-A9AB-A7F0CD197129} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files (x86)\BlueStacks\HD-StartLauncher.exe"
Task: {4DEFCC07-ACB2-4B78-9C2D-5E017B27B6A9} - System32\Tasks\{3C9A141B-419D-4002-A2CA-2159148DB79E} => C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
Task: {5181B170-CAC3-467B-A4DB-FE54FEF884B7} - System32\Tasks\{B28959DD-C9C5-420E-8A9E-8D843DEDF87A} => pcalua.exe -a E:\FSetup.exe -d E:\
Task: {524BF74F-9B79-406C-876E-C7C1D616E3E8} - System32\Tasks\{8C5AB6D8-233E-4ED9-9E3B-3CD8723FD37F} => C:\Program Files (x86)\Line6\BackTrack Setup Utility\BackTrack Setup Utility.exe [2012-07-30] (Line 6, Inc.)
Task: {54F65104-84EB-47AA-AB1A-7035632FC313} - System32\Tasks\{CD3C0597-4080-4693-B3DD-2D241916A1E6} => pcalua.exe -a C:\Users\HARDY\Downloads\BlueStacks-ThinInstaller_0.7.0.725.exe -d C:\Users\HARDY\Downloads
Task: {5628FD7C-FDC2-4104-9109-63B6A3665961} - System32\Tasks\{6ED33290-8B02-400B-9B3E-C49B90DFBABE} => pcalua.exe -a "C:\Program Files (x86)\MEDION GoPal Assistant\Assistant_UninstallOldPerUser.exe" -d "C:\Program Files (x86)\MEDION GoPal Assistant"
Task: {575D1430-7D0C-42DA-95D8-BE243283A149} - System32\Tasks\{20982DC0-A7D6-4D10-B57C-E7F4DAD29F14} => C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
Task: {58445BE3-F7A9-4586-A461-D80CDB5E0359} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
Task: {5B3AF5D3-DB79-4EE3-849E-D9B760DD7E43} - System32\Tasks\AdobeAAMUpdater-1.0-HARDY-PC-Neu-HARDY => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)
Task: {5C3D9495-4A8A-40E6-909D-575C7DCF0096} - System32\Tasks\{314C74CA-5DC0-4402-8419-D5A08F874B87} => pcalua.exe -a C:\Users\HARDY\Desktop\Downloads\Silverlight_x64.exe -d C:\Users\HARDY\Desktop\Downloads
Task: {681D1A17-D897-4413-B076-EA22519837DA} - System32\Tasks\Express FilesUpdate => C:\Program Files (x86)\ExpressFiles\EFUpdater.exe <==== ATTENTION
Task: {6E48003F-B06C-45A2-BB5E-115AF12F9901} - System32\Tasks\{802B389C-38BD-4B11-BCD6-21C39C2EC9C7} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {73B747D4-4652-4663-AFD3-F4476B42AB56} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {7CFAB931-83DD-4BCB-B6A5-12DA32CA5A81} - System32\Tasks\{D23C8B30-7D2B-4F6B-9CE5-7E4AEEACAEFA} => pcalua.exe -a "C:\Program Files (x86)\Line6\BackTrack Setup Utility\BackTrack Setup Utility.exe" -d "C:\Program Files (x86)\Line6\BackTrack Setup Utility"
Task: {7DB7619A-CC9B-4BB6-8F62-F574EDE06AC0} - System32\Tasks\{ED305C0B-E1FA-4171-8C8D-B8B5ACBBD759} => pcalua.exe -a "C:\Users\HARDY\Music\Ex.Fi.music\GuitarTricks.com Learn Guitar Tricks Video Lessons Tutorial\GuitarTricksVideoPlayer.exe" -d "C:\Users\HARDY\Music\Ex.Fi.music\GuitarTricks.com Learn Guitar Tricks Video Lessons Tutorial"
Task: {84ABDE2E-361E-4296-84F8-94FCC634DEB2} - System32\Tasks\Divx-Online-Aktualisierungsprogramm => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
Task: {84B91E6B-2D21-42DD-956C-F85F4FE126B2} - System32\Tasks\{BC4C6CFC-FCC3-43C1-80AC-5CE4D99AACE5} => C:\Program Files (x86)\Line6\BackTrack Setup Utility\BackTrack Setup Utility.exe [2012-07-30] (Line 6, Inc.)
Task: {8D1674D8-9973-4E0A-94A3-392960062A34} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {8EE5251C-F894-4179-9C22-2D20A54A32B6} - System32\Tasks\{01D13927-EBED-4E36-A400-5DECE39709A9} => C:\Program Files (x86)\Ahead\CoverDesigner\CoverDes.exe [2004-04-15] (Ahead Software AG)
Task: {901B4D67-8377-4153-BEAD-B1AA7A46AB1A} - System32\Tasks\{48EFBEA0-DA6C-401F-93BD-B0E04A62A8B5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
Task: {9322C93A-A674-4FD5-89DA-A19531B148EB} - System32\Tasks\{460EAC6F-0AFE-4AB5-8657-831693429A6E} => pcalua.exe -a C:\Users\HARDY\Desktop\BlueStacks-ThinInstaller_0.7.0.725.exe -d C:\Users\HARDY\Desktop
Task: {97FB23E3-6BA7-4D39-B8ED-1A9D76249CB4} - System32\Tasks\{30145EAF-8D60-42D4-863A-6C4141EA2CEE} => C:\Program Files (x86)\Samsung\AllShare\AllShare.exe [2012-03-01] (Samsung Electronics Co., Ltd.)
Task: {AA3CF6B7-F363-4E9F-9BA5-B23B845AEE5C} - System32\Tasks\{DE00E98D-63ED-4E35-8921-F23C8D409B38} => C:\Program Files (x86)\M-DVD.Org V2\M-DVD_Org.exe [2005-10-28] (SynApp GmbH)
Task: {AC09C7F6-EF6B-41C4-974D-23F6632561E9} - System32\Tasks\{FDA84CF0-A618-435B-A9E8-545843F2BDDA} => C:\Program Files (x86)\BlueStacks\HD-StartLauncher.exe
Task: {AD26D56E-D089-40AC-A3C7-B14BE6E66741} - System32\Tasks\{0CC5FEDB-992C-4E71-8859-F1BA3AAA8F18} => pcalua.exe -a C:\Users\HARDY\Downloads\Cinergy_HTC_Stick_Drv_Setup_5.09.1202.00_XP_Vista_7.exe -d C:\Users\HARDY\Downloads
Task: {ADC744E4-FC78-4793-B992-DE36840C9640} - System32\Tasks\{0E5C7BB1-C80B-4D91-AF1E-0332A31B448F} => C:\Program Files (x86)\Adobe Download Assistant\Adobe Download Assistant.exe
Task: {AE77B395-F8C1-4190-A852-EE83DC16E29A} - System32\Tasks\{CE222FC8-9669-483F-89F1-0486D79D29B4} => C:\Program Files (x86)\RssBandit\RSSBandit.exe
Task: {B3EFAB65-51E8-415D-A6AC-F11314027236} - System32\Tasks\{780B4A00-C1FC-400B-BEBA-13D528E78FFB} => C:\Program Files (x86)\BlueStacks\HD-StartLauncher.exe
Task: {BA45BD61-FDC3-4509-90A3-DA31C8D9FEAB} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {C2A00F78-2543-4964-B095-E83C9BE0202C} - System32\Tasks\{8719663D-A1F3-4EDE-8726-A0E44BEFF8F1} => pcalua.exe -a C:\Users\HARDY\Desktop\BlueStacks-ThinInstaller_0.7.0.722.exe -d C:\Users\HARDY\Desktop
Task: {C4EF3A20-157D-41BC-9832-FA80D8320326} - System32\Tasks\{1E730C56-CBFE-47A9-A175-2A6144A0A0B2} => C:\Program Files (x86)\Ahead\Nero\nero.exe [2004-05-06] (Ahead Software AG)
Task: {C81E95F1-6124-40D2-97D9-A83BD67BD421} - System32\Tasks\{E540C571-F025-406A-8C5A-F144F3FF899F} => pcalua.exe -a "C:\Program Files (x86)\MEDION GoPal Assistant\Assistant_Uninstaller.exe" -d "C:\Program Files (x86)\MEDION GoPal Assistant"
Task: {CF05FB4E-824A-404E-BE7F-6CE72D0E53F2} - System32\Tasks\{C41F6EF2-10D5-4426-9DCF-4A6EFECBCD69} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {CF9D471F-2AAA-4ED4-B5E0-9E2DA9735D25} - System32\Tasks\{86B33A8D-29F0-4297-ACA3-D1394DE020CA} => pcalua.exe -a E:\Home_Cinema\Setup.exe -d E:\Home_Cinema
Task: {D6C690BB-4EB5-4D06-AA56-9996A3F0E813} - System32\Tasks\{505E1B58-5E96-4D62-BF85-AA982B1E160F} => C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
Task: {D7C2F35D-C393-4A5D-AD63-C9E79494E65F} - System32\Tasks\{C2A63AA0-D21A-4AA0-B7C8-CC814CE913F3} => pcalua.exe -a "C:\Program Files (x86)\watchmi\Tvd.InstallHelper.exe" -d "C:\Program Files (x86)\watchmi"
Task: {E2D5B4A6-E936-4756-83D2-8B88D04F116B} - System32\Tasks\{4A8193B0-05BB-42F4-A752-A75DE28207D1} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {E520ADE3-7729-4FC3-9EDF-1B09A538FCE6} - System32\Tasks\{29443092-5F7D-4414-86A8-265824F62EB2} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {E94DD10D-FD72-48AB-9CBD-91007D990F99} - System32\Tasks\{F0775678-A8F8-446D-B2F7-3D956D048803} => C:\Program Files (x86)\EvilLyrics\EvilLyrics.exe <==== ATTENTION
Task: {EA6C3919-32EF-4153-8367-E7A035EE5F31} - System32\Tasks\{ED2DC00A-6486-4DCE-B8BA-E0D9A7089A4D} => C:\Program Files (x86)\MEDION GoPal Assistant\GoPal_Assistant.exe [2013-11-20] (MEDION)
Task: {ECB8AF17-E5A6-4977-8C17-C795D546D4D9} - System32\Tasks\{6AC9A34D-B86D-45D2-A7B7-F7D87546F115} => C:\Program Files (x86)\Adobe Download Assistant\Adobe Download Assistant.exe
Task: {EF8F9F25-B3CD-45FC-9647-B6D28DFC5156} - System32\Tasks\{C447C259-0B28-4827-9929-E3EB6BDD4D08} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {F6F0702F-2479-449F-9FA9-81774499CA59} - System32\Tasks\{61F45520-D525-4268-82D0-FE6FFB16268B} => C:\Program Files (x86)\Samsung\AllShare\AllShare.exe [2012-03-01] (Samsung Electronics Co., Ltd.)
Task: {FFB5A3D0-32D3-40F5-89FD-7BFA071CCB3A} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe [2012-05-29] (TuneUp Software)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-04-27 07:15 - 2014-12-16 15:31 - 00025088 _____ () C:\Program Files\Samsung\Samsung Link\JniSys.dll
2014-05-24 08:38 - 2014-12-16 15:31 - 02633728 _____ () C:\Program Files\Samsung\Samsung Link\scone_proxy.dll
2014-05-24 08:38 - 2014-12-16 15:31 - 02540544 _____ () C:\Program Files\Samsung\Samsung Link\scone_stub.dll
2013-12-21 10:25 - 2013-12-21 10:25 - 00036864 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\JNIInterface.dll
2013-12-21 10:26 - 2013-12-21 10:26 - 00144384 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\ASFAPI.dll
2013-12-21 10:27 - 2013-12-21 10:27 - 00018944 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\MediaDB_Manager.dll
2013-10-22 08:52 - 2013-10-22 08:52 - 00030720 _____ () C:\Windows\system32\MediaDB64.dll
2013-10-22 08:52 - 2013-10-22 08:52 - 00908800 _____ () C:\Windows\system32\ContentDirectoryPresenter64.dll
2013-12-21 10:27 - 2013-12-21 10:27 - 00521728 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\DMS_Manager.dll
2013-07-23 18:19 - 2013-07-23 18:19 - 00049152 _____ () C:\Windows\system32\boost_date_time-vc90-mt-1_47.dll
2013-07-23 18:19 - 2013-07-23 18:19 - 00016896 _____ () C:\Windows\system32\boost_system-vc90-mt-1_47.dll
2013-07-23 18:19 - 2013-07-23 18:19 - 00058880 _____ () C:\Windows\system32\boost_thread-vc90-mt-1_47.dll
2013-07-23 18:19 - 2013-07-23 18:19 - 00299520 _____ () C:\Windows\system32\boost_serialization-vc90-mt-1_47.dll
2013-04-27 07:15 - 2014-12-16 15:31 - 00049664 _____ () C:\Program Files\Samsung\Samsung Link\JniIO.dll
2015-01-12 08:39 - 2015-01-12 08:39 - 00669696 _____ () C:\Windows\Temp\sqlite-3.7.151-amd64-sqlitejdbc.dll
2014-05-28 05:24 - 2014-05-28 05:24 - 00706560 _____ () C:\Program Files\002\yewimmxqbs64.exe
2015-01-14 09:07 - 2015-01-14 09:07 - 01169920 _____ () c:\windows\temp\db22.exe
2012-06-21 08:39 - 2012-06-05 18:55 - 00091648 _____ () C:\Program Files (x86)\MediaMonkey\DeskPlayer.dll
2012-09-27 05:51 - 2012-09-27 05:51 - 01834496 _____ () C:\Program Files (x86)\MEDION\MEDION NAS TOOL\MEDION NAS TOOL.exe
2011-09-16 00:16 - 2011-09-16 00:16 - 00322784 _____ () C:\Program Files (x86)\Memeo\AutoBackup\InstantBackup.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\HARDY\Documents\2013-09-08 09.43.35.jpg:com.dropbox.attributes

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeActiveFileMonitor11.0 => 2
MSCONFIG\Services: AdobeActiveFileMonitor8.0 => 2
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: DevoloNetworkService => 2
MSCONFIG\Services: FontCache => 2
MSCONFIG\Services: Samsung Link Service => 2
MSCONFIG\Services: SimpleSlideShowServer => 3
MSCONFIG\Services: WMPNetworkSvc => 2

========================= Accounts: ==========================

Administrator (S-1-5-21-2389243879-3189858854-901359939-500 - Administrator - Disabled)
Gast (S-1-5-21-2389243879-3189858854-901359939-501 - Limited - Enabled) => C:\Users\Gast
HARDY (S-1-5-21-2389243879-3189858854-901359939-1000 - Administrator - Enabled) => C:\Users\HARDY
HomeGroupUser$ (S-1-5-21-2389243879-3189858854-901359939-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/13/2015 00:22:14 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (01/13/2015 06:46:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x59f4
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (01/13/2015 06:46:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x5628
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (01/13/2015 06:46:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x6004
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (01/13/2015 05:47:39 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: NT-AUTORITÄT)
Description: Die Anwendung oder der Dienst "Compatibility Verify" konnte nicht heruntergefahren werden.

Error: (01/12/2015 07:58:16 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (01/12/2015 06:44:45 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (01/12/2015 02:54:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Ausnahmecode: 0x4000001f
Fehleroffset: 0x0022ecf0
ID des fehlerhaften Prozesses: 0x210a0
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (01/12/2015 02:54:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00a1a4ae
ID des fehlerhaften Prozesses: 0x6edc
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (01/11/2015 08:29:09 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\vcredist_x86.exe Verifier\vcredist_x86.exe" /norestart /quiet /install; Beschreibung = Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005; Fehler = 0x800706be).


System errors:
=============
Error: (01/14/2015 03:02:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Compatibility Verify" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/14/2015 02:56:53 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk4\DR4 gefunden.

Error: (01/14/2015 02:56:53 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk4\DR4 gefunden.

Error: (01/14/2015 02:56:52 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk4\DR4 gefunden.

Error: (01/14/2015 02:56:52 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk4\DR4 gefunden.

Error: (01/14/2015 02:56:51 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk4\DR4 gefunden.

Error: (01/14/2015 02:48:25 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (01/14/2015 01:30:30 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Compatibility Verify" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/14/2015 01:29:25 PM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: 192.168.178.22192.168.137.0255.255.255.0

Error: (01/14/2015 01:29:25 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:


Microsoft Office Sessions:
=========================
Error: (01/13/2015 00:22:14 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\Epson Software\Download Navigator\EPSDNAVI.EXE

Error: (01/13/2015 06:46:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe34.0.5.54435475dd5dmozalloc.dll34.0.5.54435475d664800000030000142559f401d02eefaefd0230C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll7feec848-9ae7-11e4-a7d5-8c89a5cac3ba

Error: (01/13/2015 06:46:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe34.0.5.54435475dd5dmozalloc.dll34.0.5.54435475d6648000000300001425562801d02eefad2925b6C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll7fe419c0-9ae7-11e4-a7d5-8c89a5cac3ba

Error: (01/13/2015 06:46:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe34.0.5.54435475dd5dmozalloc.dll34.0.5.54435475d6648000000300001425600401d02eefae3a2486C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll7b3aa476-9ae7-11e4-a7d5-8c89a5cac3ba

Error: (01/13/2015 05:47:39 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: NT-AUTORITÄT)
Description: 1C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exeCompatibility Verify0302621612280143003A005C00550073006500720073005C00480041005200440059005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C0043006F006D007000610074006900620069006C006900740079002000560065007200690066006900650072005C0063006F006D007000610074006900620069006C0069007400790063006800650063006B007300760063002E006500780065000000

Error: (01/12/2015 07:58:16 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\Epson Software\Download Navigator\EPSDNAVI.EXE

Error: (01/12/2015 06:44:45 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\Epson Software\Download Navigator\EPSDNAVI.EXE

Error: (01/12/2015 02:54:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054af4124compatibilitycheck.exe0.0.0.054af41244000001f0022ecf0210a001d02e6f31408efeC:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe97ef621e-9a62-11e4-ba92-8c89a5cac3ba

Error: (01/12/2015 02:54:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054af4124compatibilitycheck.exe0.0.0.054af4124c000000500a1a4ae6edc01d02e595053f85dC:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe81e7af9b-9a62-11e4-ba92-8c89a5cac3ba

Error: (01/11/2015 08:29:09 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\vcredist_x86.exe Verifier\vcredist_x86.exe" /norestart /quiet /installMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.210050x800706be


CodeIntegrity Errors:
===================================
  Date: 2014-12-16 07:31:44.272
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-16 07:31:44.212
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-12 20:15:06.889
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-12 20:15:06.887
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-12 20:15:06.872
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-12 20:15:06.870
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-12 20:13:57.338
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-12 20:13:57.309
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-26 08:08:01.158
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-26 08:08:00.922
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) CPU G630 @ 2.70GHz
Percentage of memory in use: 77%
Total physical RAM: 3975.64 MB
Available physical RAM: 880.02 MB
Total Pagefile: 7949.46 MB
Available Pagefile: 3640.1 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:414.66 GB) (Free:15.36 GB) NTFS
Drive d: (Recover) (Fixed) (Total:50 GB) (Free:16.84 GB) NTFS
Drive g: (Lexar) (Removable) (Total:58.5 GB) (Free:27.43 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: DD3B8AC5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=414.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

========================================================
Disk: 4 (MBR Code: Windows XP) (Size: 58.5 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=58.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================

deeprybka 14.01.2015 18:27
Hi,

Schritt 1

http://deeprybka.trojaner-board.de/m...mbamlogo4a.pnghttp://deeprybka.trojaner-board.de/m...mbamlogo4b.png
  • Download
  • Installiere das Programm in den vorgegebenen Pfad.
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
  • Unter Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
  • Klicke im Anschluss auf "Suchlauf", wähle den Bedrohungssuchlauf aus, aktualisiere die Datenbanken und klicke auf "Suchlauf jetzt starten".
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. (geht so...)
  • Poste mir den Inhalt der Logdatei (geht so...). Klicke dazu auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Klicke auf "In Zwischenablage kopieren" poste mir den Inhalt in Code-Tags als Antwort in den Thread.

Schritt 2
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


(Kaspersky vor und während Schritt 3 deaktivieren - anschließend wieder einschalten)

Schritt 3
Download von https://sites.google.com/site/canned...b27e2-Zoek.png ZOEK (by Smeenk)
  • Speichere die zoek.exe auf dem Desktop.
  • Bitte deaktiviere während der Verwendung von Zoek Deinen Virenscanner, da dieser Zoek stören könnte.
  • Starte die zoek.exe mit einem Doppelklick und warte bis die Programmoberfläche erscheint (ca. 30 Sekunden)
  • Kopiere den Text der folgenden Box in das Skriptfenster von Zoek:
    Code:
    filesrcm;
    autoclean;
    FFdefaults;
    iedefaults;
    emptyclsid;
    services-list;
    systemspecs;
  • Nun klicke auf "Run script" und sei geduldig bis das Skript durchgelaufen ist.

    Zitat:
    Zoek.exe is running now.
    Do not start any browser windows, they may get closed automatically.
    Please wait! This window will close when finished.
    A logfile will open afterwards and can also be found on your systemdrive as zoek-results.log
  • Wenn das Tool fertig ist, wird sich eine Logdatei öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter C:\
  • Bitte poste mir das zoek-results.log.

Schritt 4

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut, markiere auch die checkbox http://deeprybka.trojaner-board.de/b...t/addition.pngund drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.

HartmutA 14.01.2015 19:55
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 14.01.2015
Suchlauf-Zeit: 19:14:56
Logdatei:
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.01.14.08
Rootkit Datenbank: v2015.01.07.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: HARDY

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 405358
Verstrichene Zeit: 21 Min, 26 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 2
Adware.Adpeak, C:\Program Files\002\yewimmxqbs64.exe, 2404, Löschen bei Neustart, [53fd35c24b3e162014bef06e12f36799]
PUP.Optional.AdPeak.A, C:\Program Files\002\yewimmxqbs64.exe, 2404, Löschen bei Neustart, [88c8cb2cc4c556e0cf3b9b5714f04fb1]

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 60
Adware.Adpeak, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\yewimmxqbs64, In Quarantäne, [53fd35c24b3e162014bef06e12f36799],
PUP.Optional.Delta.A, HKLM\SOFTWARE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}, In Quarantäne, [2c24da1d553412243e3f70b20df636ca],
PUP.Optional.Delta.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}, In Quarantäne, [2c24da1d553412243e3f70b20df636ca],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\APPID\{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}, In Quarantäne, [83cdd52246432d09f296fa280201ba46],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}, In Quarantäne, [83cdd52246432d09f296fa280201ba46],
PUP.Optional.FunMoods.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}, In Quarantäne, [69e7bb3cb8d17fb7e1828c719c66f709],
PUP.Optional.FunMoods.A, HKLM\SOFTWARE\CLASSES\funmoods.funmoodsHlpr.1, In Quarantäne, [69e7bb3cb8d17fb7e1828c719c66f709],
PUP.Optional.FunMoods.A, HKLM\SOFTWARE\CLASSES\funmoods.funmoodsHlpr, In Quarantäne, [69e7bb3cb8d17fb7e1828c719c66f709],
PUP.Optional.FunMoods.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\funmoods.funmoodsHlpr, In Quarantäne, [69e7bb3cb8d17fb7e1828c719c66f709],
PUP.Optional.FunMoods.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}, In Quarantäne, [69e7bb3cb8d17fb7e1828c719c66f709],
PUP.Optional.FunMoods.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\funmoods.funmoodsHlpr.1, In Quarantäne, [69e7bb3cb8d17fb7e1828c719c66f709],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}, In Quarantäne, [7bd5cd2a8aff9d99555a3ce21ee57987],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}, In Quarantäne, [54fc8671474278bef1c1a67835ce9e62],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\CLASSES\funmoods.dskBnd.1, In Quarantäne, [54fc8671474278bef1c1a67835ce9e62],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\CLASSES\funmoods.dskBnd, In Quarantäne, [54fc8671474278bef1c1a67835ce9e62],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\funmoods.dskBnd, In Quarantäne, [54fc8671474278bef1c1a67835ce9e62],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\funmoods.dskBnd.1, In Quarantäne, [54fc8671474278bef1c1a67835ce9e62],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}, In Quarantäne, [064af8ffb9d0b0866053ea347b88a55b],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\CLASSES\funmoodsApp.appCore.1, In Quarantäne, [064af8ffb9d0b0866053ea347b88a55b],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\CLASSES\funmoodsApp.appCore, In Quarantäne, [064af8ffb9d0b0866053ea347b88a55b],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\funmoodsApp.appCore, In Quarantäne, [064af8ffb9d0b0866053ea347b88a55b],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\funmoodsApp.appCore.1, In Quarantäne, [064af8ffb9d0b0866053ea347b88a55b],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}, In Quarantäne, [aba5fef9315868ced5df8599fa099967],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\CLASSES\f, In Quarantäne, [aba5fef9315868ced5df8599fa099967],
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\f, In Quarantäne, [aba5fef9315868ced5df8599fa099967],
PUP.Optional.Babylon.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, In Quarantäne, [50003eb93f4a69cd7a973dac72908779],
PUP.Optional.Babylon.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}, In Quarantäne, [50003eb93f4a69cd7a973dac72908779],
PUP.Optional.MySearchDial.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}, In Quarantäne, [82ce9b5c3a4f142255eb6287c33f837d],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}, In Quarantäne, [82ce9b5c3a4f142255eb6287c33f837d],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{68B81CCD-A80C-4060-8947-5AE69ED01199}, In Quarantäne, [1a3643b4e9a0aa8c962dd54d3ac93bc5],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E6B969FB-6D33-48d2-9061-8BBD4899EB08}, In Quarantäne, [450b2ec99cedfd39f0d4f32fb54e25db],
PUP.Optional.AdPeak.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\yewimmxqbs64, In Quarantäne, [88c8cb2cc4c556e0cf3b9b5714f04fb1],
PUP.Optional.AdPeak.A, HKLM\SOFTWARE\LevelQualityWatcher, In Quarantäne, [6be546b1addc1323288aa4eb0bf825db],
PUP.Optional.RRSavings.A, HKLM\SOFTWARE\rrsavings, In Quarantäne, [d878dc1b30592a0c33106937a360ba46],
PUP.Funmoods, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\bbjciahceamgodcoidkjpchnokgfpphh, In Quarantäne, [65eb2acdb7d2142206184a7348bb50b0],
PUP.Optional.FunMoods.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\cjpglkicenollcignonpgiafdgfeehoj, In Quarantäne, [9fb191666425b28425a727810bf922de],
PUP.Optional.Babylon.A, HKLM\SOFTWARE\WOW6432NODE\babylontoolbar, In Quarantäne, [1c34b245fd8c191d3a24bb0f7f85cb35],
PUP.Optional.DataMangr.A, HKLM\SOFTWARE\WOW6432NODE\DataMngr, In Quarantäne, [222e1bdc0287d363a9bb41552bd8c53b],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\Iminent, In Quarantäne, [4010b93efb8ee84e169d179c1ee5b44c],
PUP.Funmoods, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\bbjciahceamgodcoidkjpchnokgfpphh, In Quarantäne, [57f9cf281a6f40f63fdf18a592719c64],
PUP.Optional.FunMoods.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\cjpglkicenollcignonpgiafdgfeehoj, In Quarantäne, [0b45f8ff51382d09c20a9e0a9371c937],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\INSTALLCORE\mysearchdial, In Quarantäne, [163a4cab8108bf77a0959c2c8b7932ce],
PUP.Optional.CompatibilityVerifier.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Verifies and fixes application compatibility issues, In Quarantäne, [54fca057b2d71224338d610c857ed828],
PUP.Optional.DataMngr.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr, In Quarantäne, [eb65cc2bb3d670c6f5bf13b539cb768a],
PUP.Optional.DataMngr.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar, In Quarantäne, [c28e7f787d0cbf777a390bbdce36b24e],
PUP.Optional.DataMngr.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr, In Quarantäne, [044c0bec38517eb83d7704c463a19769],
PUP.Optional.DataMngr.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar, In Quarantäne, [351ba35456333006c5eea72128dc8977],
PUP.Optional.Delta.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\delta LTD, In Quarantäne, [e46c11e67613d165b0af686222e2728e],
PUP.Optional.Iminent.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Iminent, In Quarantäne, [18389b5c2b5e181e278d3d768a79cb35],
PUP.Optional.MySearchDial.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\mysearchdial, In Quarantäne, [56fa37c0ddac11253b9801c8c93b54ac],
PUP.Optional.Conduit.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\ConduitSearchScopes, In Quarantäne, [cb8526d199f077bf4a1395e00201748c],
PUP.Optional.PassShow.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PassShow, In Quarantäne, [153bc82fd6b38caa5c630872659ee11f],
PUP.Optional.RRSavings.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Rr Savings, In Quarantäne, [67e9a453b7d2c96de265dec220e33ac6],
PUP.Optional.Babylon.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\BABSOLUTION\Updater, In Quarantäne, [93bd0aedabde4fe7d5e217b207fdb44c],
PUP.Optional.Conduit.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CONDUIT\FF, In Quarantäne, [470957a02f5a152158eb725c64a0ff01],
PUP.Funmoods, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\bbjciahceamgodcoidkjpchnokgfpphh, In Quarantäne, [6be51cdb6d1ca78f1b029d2082816c94],
PUP.Optional.FunMoods.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\cjpglkicenollcignonpgiafdgfeehoj, In Quarantäne, [eb6565926b1e0630f7d6deca3cc8738d],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [fd538275e8a1ae881ba9436f15ee9b65],
PUP.Optional.MySearchDial.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\mysearchdial, In Quarantäne, [222e31c6424777bf3847eedfb054728e],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [ba9638bfaedb9c9a677051775ea6cc34],

Registrierungswerte: 7
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}, Funmoods Toolbar, In Quarantäne, [54fc8671474278bef1c1a67835ce9e62]
PUP.Optional.Funmoods.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}, In Quarantäne, [bb95d81f84053303eac8e23c5ba86e92],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\Mysearchdial\1.8.29.0\, In Quarantäne, [d080f2052e5b95a195807d6be61e867a]
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|webbooster@iminent.com, C:\Program Files (x86)\Iminent\webbooster@iminent.com, In Quarantäne, [3f11eb0ccfbac96d7320e29cfe054db3]
PUP.Optional.InstallCore.A, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, zr2X2X1G1S1F2V1S2Q0V, In Quarantäne, [ba9638bfaedb9c9a677051775ea6cc34]
PUP.Optional.BProtector, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|BrowserMngr Start Page, hxxp://isearch.claro-search.com/?affID=114161&tt=120812_bandext_3312_1&babsrc=HP_iclro&mntrId=204c3cc00000000000008c89a5cac3ba, In Quarantäne, [dd73a5527415171fcad1765fa75d01ff]
PUP.BProtector, HKU\S-1-5-21-2389243879-3189858854-901359939-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|bProtectorDefaultScope, {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, In Quarantäne, [2b2532c5ddac181e536317b1ed17b34d]

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 31
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\locales, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\HARDY\AppData\Roaming\Compatibility Verifier, In Quarantäne, [d87816e1bacfd95d744a17562bd833cd],
PUP.Optional.CompatibilityVerifier.A, C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\locales, In Quarantäne, [d87816e1bacfd95d744a17562bd833cd],
PUP.Optional.Blabbers, C:\Program Files (x86)\BrowserCompanion, In Quarantäne, [a1af8a6dc3c685b1bbc33a5725dfd52b],
PUP.Optional.Delta.A, C:\Users\HARDY\AppData\Roaming\BabSolution\Shared, In Quarantäne, [be9239be8702092d079ac422c93b17e9],
PUP.Optional.AdPeak.A, C:\Program Files\002, Löschen bei Neustart, [88c8cb2cc4c556e0cf3b9b5714f04fb1],
PUP.Optional.MySearchDial.A, C:\Users\HARDY\AppData\Roaming\mysearchdial, In Quarantäne, [4a067a7de8a185b1c39e092d19eafe02],
PUP.Optional.MySearchDial.A, C:\Users\HARDY\AppData\Roaming\mysearchdial\icons_2.20.6.0, In Quarantäne, [4a067a7de8a185b1c39e092d19eafe02],
PUP.Optional.MySearchDial.A, C:\Users\HARDY\AppData\Roaming\mysearchdial\UpdateProc, In Quarantäne, [4a067a7de8a185b1c39e092d19eafe02],
PUP.Optional.OpenCandy, C:\Users\HARDY\AppData\Roaming\OpenCandy, In Quarantäne, [e9679d5a8009b1852d4066d0748f5fa1],
PUP.Optional.OpenCandy, C:\Users\HARDY\AppData\Roaming\OpenCandy\3D111C762B8C4190839694E9793A5CBA, In Quarantäne, [e9679d5a8009b1852d4066d0748f5fa1],
PUP.Optional.OpenCandy, C:\Users\HARDY\AppData\Roaming\OpenCandy\53CA7A7E561940F4B470B8EFB18D775E, In Quarantäne, [e9679d5a8009b1852d4066d0748f5fa1],
PUP.Optional.OpenCandy, C:\Users\HARDY\AppData\Roaming\OpenCandy\68DFF53A2E77435884614B678E66B439, In Quarantäne, [e9679d5a8009b1852d4066d0748f5fa1],
PUP.Optional.OpenCandy, C:\Users\HARDY\AppData\Roaming\OpenCandy\7434DE3EE0144F6FA552DB5BB4698FB8, In Quarantäne, [e9679d5a8009b1852d4066d0748f5fa1],
PUP.Optional.OpenCandy, C:\Users\HARDY\AppData\Roaming\OpenCandy\79955E9209874D90907C2BD01E642E54, In Quarantäne, [e9679d5a8009b1852d4066d0748f5fa1],
PUP.Optional.OpenCandy, C:\Users\HARDY\AppData\Roaming\OpenCandy\80EEE0CF69304DBAA9407637FD18C53A, In Quarantäne, [e9679d5a8009b1852d4066d0748f5fa1],
PUP.Optional.OpenCandy, C:\Users\HARDY\AppData\Roaming\OpenCandy\B2F9CD60DB474066A9F4443FA5007B24, In Quarantäne, [e9679d5a8009b1852d4066d0748f5fa1],
PUP.Optional.RRSavings.A, C:\Program Files\rrsavings, In Quarantäne, [dc746691abde0e2898184df4a06339c7],
PUP.Optional.RRSavings.A, C:\Program Files\RrFilter, In Quarantäne, [143c87702b5e58de0ca573ce4ab936ca],
PUP.Optional.RRSavings.A, C:\Program Files\RrFilter\SSL, In Quarantäne, [143c87702b5e58de0ca573ce4ab936ca],
PUP.Optional.PassShow.A, C:\Program Files (x86)\PassShow-soft, In Quarantäne, [81cf8f68b1d892a4097afa4954afda26],
PUP.Optional.BabSolution.A, C:\Users\HARDY\AppData\Roaming\BabSolution\CR, In Quarantäne, [f35d3eb9addc4ee8d01a0a437f8405fb],
PUP.Optional.DSearchLink.A, C:\ProgramData\DSearchLink, In Quarantäne, [7ed28c6b8cfd1f17720c74e7ae55bc44],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.565.25, In Quarantäne, [5df3fafd612879bd49bc4c1c758eb24e],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}, In Quarantäne, [5df3fafd612879bd49bc4c1c758eb24e],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings, In Quarantäne, [5df3fafd612879bd49bc4c1c758eb24e],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],

Dateien: 122
Adware.Adpeak, C:\Program Files\002\yewimmxqbs64.exe, Löschen bei Neustart, [53fd35c24b3e162014bef06e12f36799],
PUP.Optional.Babylon.A, C:\Users\HARDY\AppData\Roaming\OpenCandy\3D111C762B8C4190839694E9793A5CBA\DeltaTB.exe, In Quarantäne, [e46cc92e593016204eae3dea04fdff01],
PUP.Optional.OpenCandy.A, C:\Users\HARDY\AppData\Roaming\OpenCandy\68DFF53A2E77435884614B678E66B439\Setupsft_chr_p1v7.exe, In Quarantäne, [80d0fdfadeab2b0b8957de7e8184837d],
PUP.Optional.Babylon.A, C:\Users\HARDY\AppData\Roaming\OpenCandy\80EEE0CF69304DBAA9407637FD18C53A\DeltaTB.exe, In Quarantäne, [78d8da1de2a7b87e06f669be9f62aa56],
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\OpenCandy\B2F9CD60DB474066A9F4443FA5007B24\Softonic_chr_1.8.21.14.exe, In Quarantäne, [a0b0ca2d95f4e55133a7338f50b1d12f],
PUP.Optional.OpenCandy.A, C:\Users\HARDY\AppData\Roaming\OpenCandy\B2F9CD60DB474066A9F4443FA5007B24\Softonic_chr_p1v6.exe, In Quarantäne, [fd5341b6acddc96df5eb2c303ec757a9],
PUP.Optional.BrowserCompanion.A, C:\Program Files (x86)\BrowserCompanion\BCHelper.exe, In Quarantäne, [98b808efeb9ed561ef00b277738eb947],
PUP.Optional.ExpressFiles.A, C:\Users\HARDY\Programme ect\EFinstaller.exe, In Quarantäne, [5cf454a360296ec84973ca5e5ca4fc04],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\cef.pak, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\cef_100_percent.pak, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\cef_200_percent.pak, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\d3dcompiler_46.dll, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\ffmpegsumo.dll, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\icudtl.dat, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\libEGL.dll, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\libGLESv2.dll, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\NPSWF32_15_0_0_189.dll, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\Default\AppData\Roaming\Compatibility Verifier\vcredist_x86.exe, In Quarantäne, [b19fcb2ccfba88aeecd2026b669d8a76],
PUP.Optional.CompatibilityVerifier.A, C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\cef.pak, In Quarantäne, [d87816e1bacfd95d744a17562bd833cd],
PUP.Optional.CompatibilityVerifier.A, C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\cef_100_percent.pak, In Quarantäne, [d87816e1bacfd95d744a17562bd833cd],
PUP.Optional.CompatibilityVerifier.A, C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\cef_200_percent.pak, In Quarantäne, [d87816e1bacfd95d744a17562bd833cd],
PUP.Optional.CompatibilityVerifier.A, C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\d3dcompiler_46.dll, In Quarantäne, [d87816e1bacfd95d744a17562bd833cd],
PUP.Optional.CompatibilityVerifier.A, C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\ffmpegsumo.dll, In Quarantäne, [d87816e1bacfd95d744a17562bd833cd],
PUP.Optional.CompatibilityVerifier.A, C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\icudtl.dat, In Quarantäne, [d87816e1bacfd95d744a17562bd833cd],
PUP.Optional.CompatibilityVerifier.A, C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\libEGL.dll, In Quarantäne, [d87816e1bacfd95d744a17562bd833cd],
PUP.Optional.CompatibilityVerifier.A, C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\libGLESv2.dll, In Quarantäne, [d87816e1bacfd95d744a17562bd833cd],
PUP.Optional.CompatibilityVerifier.A, C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\NPSWF32_15_0_0_189.dll, In Quarantäne, [d87816e1bacfd95d744a17562bd833cd],
PUP.Optional.CompatibilityVerifier.A, C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\vcredist_x86.exe, In Quarantäne, [d87816e1bacfd95d744a17562bd833cd],
PUP.Optional.BProtector.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\bProtector_extensions.sqlite, In Quarantäne, [82ceee09ed9c0135af6ebeea3ec52cd4],
PUP.Optional.BProtector.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\bprotector_prefs.js, In Quarantäne, [b19f64936920c67057c726828380728e],
PUP.Optional.Conduit.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\conduit.xml, In Quarantäne, [d67a8275533653e383b56c3c61a2b749],
PUP.Optional.Delta.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\delta.xml, In Quarantäne, [173923d45534de58123206a2f50ed42c],
PUP.Optional.MySearchDial.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\4p2387fc.default\searchplugins\Mysearchdial.xml, In Quarantäne, [0a46eb0c5f2a05317d37dace47bc8c74],
PUP.Optional.MySearchDial.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\mData\searchplugins\Mysearchdial.xml, In Quarantäne, [440c9e591a6f61d54371bbed808330d0],
PUP.Optional.Blabbers, C:\Program Files (x86)\BrowserCompanion\blabbers-ch.crx, In Quarantäne, [a1af8a6dc3c685b1bbc33a5725dfd52b],
PUP.Optional.Blabbers, C:\Program Files (x86)\BrowserCompanion\logo.ico, In Quarantäne, [a1af8a6dc3c685b1bbc33a5725dfd52b],
PUP.Optional.Blabbers, C:\Program Files (x86)\BrowserCompanion\sqlite3.dll, In Quarantäne, [a1af8a6dc3c685b1bbc33a5725dfd52b],
PUP.Optional.FunMoods.A, C:\Users\HARDY\AppData\Local\funmoods-speeddial.crx, In Quarantäne, [6ae6936447426fc7da21ca1a34d0669a],
PUP.Optional.FunMoods.A, C:\Users\HARDY\AppData\Local\funmoods.crx, In Quarantäne, [4a068f68dcad04328873c71d40c425db],
PUP.Optional.Delta.A, C:\Users\HARDY\AppData\Roaming\BabSolution\Shared\Delta.ico, In Quarantäne, [be9239be8702092d079ac422c93b17e9],
PUP.Optional.Delta.A, C:\Users\HARDY\AppData\Roaming\BabSolution\Shared\BabMaint.exe, In Quarantäne, [be9239be8702092d079ac422c93b17e9],
PUP.Optional.Delta.A, C:\Users\HARDY\AppData\Roaming\BabSolution\Shared\BUSolution.dll, In Quarantäne, [be9239be8702092d079ac422c93b17e9],
PUP.Optional.Delta.A, C:\Users\HARDY\AppData\Roaming\BabSolution\Shared\chu.js, In Quarantäne, [be9239be8702092d079ac422c93b17e9],
PUP.Optional.Delta.A, C:\Users\HARDY\AppData\Roaming\BabSolution\Shared\GUninstaller.exe, In Quarantäne, [be9239be8702092d079ac422c93b17e9],
PUP.Optional.Delta.A, C:\Users\HARDY\AppData\Roaming\BabSolution\Shared\SetupParams.ini, In Quarantäne, [be9239be8702092d079ac422c93b17e9],
PUP.Optional.Delta.A, C:\Users\HARDY\AppData\Roaming\BabSolution\Shared\sqlite3.dll, In Quarantäne, [be9239be8702092d079ac422c93b17e9],
PUP.Optional.AdPeak.A, C:\Program Files\002\yewimmxqbs64.exe, Löschen bei Neustart, [88c8cb2cc4c556e0cf3b9b5714f04fb1],
PUP.Optional.MySearchDial.A, C:\Users\HARDY\AppData\Roaming\mysearchdial\UpdateProc\config.dat, In Quarantäne, [4a067a7de8a185b1c39e092d19eafe02],
PUP.Optional.MySearchDial.A, C:\Users\HARDY\AppData\Roaming\mysearchdial\UpdateProc\info.dat, In Quarantäne, [4a067a7de8a185b1c39e092d19eafe02],
PUP.Optional.MySearchDial.A, C:\Users\HARDY\AppData\Roaming\mysearchdial\UpdateProc\STTL.DAT, In Quarantäne, [4a067a7de8a185b1c39e092d19eafe02],
PUP.Optional.MySearchDial.A, C:\Users\HARDY\AppData\Roaming\mysearchdial\UpdateProc\TTL.DAT, In Quarantäne, [4a067a7de8a185b1c39e092d19eafe02],
PUP.Optional.OpenCandy, C:\Users\HARDY\AppData\Roaming\OpenCandy\53CA7A7E561940F4B470B8EFB18D775E\Trial-14.0.1000.89_de-DE_1004733_DE-2.exe, In Quarantäne, [e9679d5a8009b1852d4066d0748f5fa1],
PUP.Optional.OpenCandy, C:\Users\HARDY\AppData\Roaming\OpenCandy\7434DE3EE0144F6FA552DB5BB4698FB8\Trial-14.0.1000.89_de-DE_1004732_DE-1.exe, In Quarantäne, [e9679d5a8009b1852d4066d0748f5fa1],
PUP.Optional.OpenCandy, C:\Users\HARDY\AppData\Roaming\OpenCandy\79955E9209874D90907C2BD01E642E54\zafwSetupWeb_131_211_000.exe, In Quarantäne, [e9679d5a8009b1852d4066d0748f5fa1],
PUP.Optional.RRSavings.A, C:\Program Files\rrsavings\uninstaller.exe, In Quarantäne, [dc746691abde0e2898184df4a06339c7],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\00, In Quarantäne, [5df3fafd612879bd49bc4c1c758eb24e],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\01, In Quarantäne, [5df3fafd612879bd49bc4c1c758eb24e],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\02, In Quarantäne, [5df3fafd612879bd49bc4c1c758eb24e],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\10, In Quarantäne, [5df3fafd612879bd49bc4c1c758eb24e],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\11, In Quarantäne, [5df3fafd612879bd49bc4c1c758eb24e],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\12, In Quarantäne, [5df3fafd612879bd49bc4c1c758eb24e],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\20, In Quarantäne, [5df3fafd612879bd49bc4c1c758eb24e],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\21, In Quarantäne, [5df3fafd612879bd49bc4c1c758eb24e],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\22, In Quarantäne, [5df3fafd612879bd49bc4c1c758eb24e],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.settings, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\bl, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\dm, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\00, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\01, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\02, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\03, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\10, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\11, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\12, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\13, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\20, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\21, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\22, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.BitGuard.A, C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\23, In Quarantäne, [72dead4a09802e08844d2a3fa162e61a],
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.admin", false);), Ersetzt,[1838f1062267f83e363b14bb45c02fd1]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (ferences

/* Do not edit this file.
 *
 ), Ersetzt,[ee62eb0c52372d09e78af7d8de2721df]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (references

/* Do not edit this file.
 *
 * If you make changes to this file ), Ersetzt,[ef612ec90d7c81b5ed84a728ac5949b7]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (e.
 *
 * If you make changes to this file while t), Ersetzt,[262a20d786032d09571ad8f7b1545aa6]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (ces

/* Do not edit this file.
 *
 * If you), Ersetzt,[aba5c6319ced93a321504f808b7a35cb]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (erences

/* Do not edit this file.
 *
 * If ), Ersetzt,[2e224fa88207f0467001a02f59ac2cd4]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (rences

/* Do not edit this file.
 *
 * If), Ersetzt,[c18fc92e2465e551f77a804f8c794bb5]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (ferences

/* Do not edit this file.
 *
 * If), Ersetzt,[3b1509eec6c37bbb561bede239ccd030]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (rences

/* Do not edit this file.
 *
 * If you m), Ersetzt,[c88843b44f3ab3833839458ae0252ad6]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (es

/* Do not edit this file.
 *
 * If y), Ersetzt,[0e428a6d53360d29432e428d70956898]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (references

/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be ove), Ersetzt,[143c2acdb4d51422c0b18946bb4a5fa1]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (tion is running,
 * the changes will be overwritten when the applicatio), Ersetzt,[3a1602f5bbce082ebdb401cee12416ea]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: ( this file.
 *
 * If you make changes to this fil), Ersetzt,[b49c65927d0c62d4d79addf2bd48c838]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (ces

/* Do not edit this file.
 *
 * If you make c), Ersetzt,[133d0aed2366fa3ce9885d728481738d]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (

/* Do not edit this file.
 *
 * If you m), Ersetzt,[262a877080094aec620fede2f411926e]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (ferences

/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwrit), Ersetzt,[d57bb146c1c85ed8472aa629dc2932ce]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (n is running,
 * the changes will be overwritten w), Ersetzt,[89c7d720692045f10a675c73eb1a53ad]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (ces

/* Do not edit this file.
 *
 * If you make ), Ersetzt,[2c2449ae7910ce68d69bdef181848d73]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (s

/* Do not edit this file.
 *
 * If you m), Ersetzt,[0b45ab4cea9f45f1bfb20bc4b05523dd]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (erences

/* Do not edit this file.
 *
 * If y), Ersetzt,[6ce421d687025adc3e33616ebc49ca36]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (ences

/* Do not edit this file.
 *
 * If you make changes to this f), Ersetzt,[133d02f5a5e4b581d59c587729dce719]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: ( this file.
 *
 * If you make changes to this file whil), Ersetzt,[72de30c75a2f0531036eb11eef164ab6]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (
/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the a), Ersetzt,[e8681add7217eb4b3839d2fd39cc3bc5]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (s running,
 * the changes will be overwritten when), Ersetzt,[5bf5a2552d5cf83e1c5597380df84fb1]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (ces

/* Do not edit this file.
 *
 * If you make changes), Ersetzt,[014f0ee9ec9d2b0b7cf520afb64f9769]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: ( Do not edit this file.
 *
 * If you make changes ), Ersetzt,[d77935c203862313640d646b0005748c]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=204c3cc00000000000000008cae02b2a");), Ersetzt,[b59b74832267d66074050fc06c995fa1]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (ity.blockautorefresh", true);
user_pref("accessibility.browsewithcaret", true);
user_pref("accessibility.typeaheadfind", true);
user_pref("acc), Ersetzt,[75db3abdb7d2b1850e6bcd02669fc23e]
PUP.Optional.Softonic.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js, Gut: (), Schlecht: (aheadfind", true);
user_pref("accessibility.typeaheadfind.flashBar", 0);
user_pref("aolde_toolbar.skin.custom", false);
user_pref("app.update.aut), Ersetzt,[153b3dba0188d6602b4e76591ce9c937]
PUP.Optional.MySearch.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\user.js, Gut: (), Schlecht: (user_pref("extensions.irmysearch.aflt", "dvd_14_18_ff");), Ersetzt,[d9772bccf990999dfa60606f2fd611ef]
PUP.Optional.MySearch.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\user.js, Gut: (), Schlecht: (lta.tlbrSrchUrl", "");
user_pref("extensions.delta.id",), Ersetzt,[3e129a5d3a4f0b2b81d91eb10afb3fc1]
PUP.Optional.MySearch.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\user.js, Gut: (), Schlecht: (lta.tlbrSrchUrl", "");
user_pref("extensions.delta.), Ersetzt,[163ad126fc8dfc3a76e4f5da9e6712ee]
PUP.Optional.MySearch.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\user.js, Gut: (), Schlecht: (s.delta.tlbrSrchUrl", "");
user_pref("extensions.delta.id", "204c3cc00000000000000008cae02b2a");
user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
user_pref("extensions.delta.instlDay", "15896");
user_pref("extensions.delta.vrsn", "1.8.21.5");
user_pref("extensions.delta.vrsni", "1.8.21.5");
user_pref("extension), Ersetzt,[57f915e295f47abc3822a22d8c791fe1]
PUP.Optional.MySearch.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\4p2387fc.default\user.js, Gut: (), Schlecht: (user_pref("extensions.irmysearch.aflt", "dvd_14_18_ff");), Ersetzt,[5cf49c5b80099d9922387659e32249b7]
PUP.Optional.MySearch.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\4p2387fc.default\user.js, Gut: (), Schlecht: (mysearch.aflt", "dvd_14_18_ff");
user_pref("extensions.), Ersetzt,[4010ae49ee9bdf578dcdd4fb1beafb05]
PUP.Optional.MySearch.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\4p2387fc.default\user.js, Gut: (), Schlecht: (mysearch.aflt", "dvd_14_18_ff");
user_pref("extensi), Ersetzt,[eb657087b7d28aac74e6b817778e768a]
PUP.Optional.MySearch.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\4p2387fc.default\user.js, Gut: (), Schlecht: (s.irmysearch.aflt", "dvd_14_18_ff");
user_pref("extensions.irmysearch.instlRef", "140305_a");
user_pref("extensions.irmysearch.cr", "1790956217");
user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1Qzuzz0Czzzy0AyD0C0A0CtA0B0AtA0C0CtDtN0D0Tzu0SzzyDtCtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyByBtB0FtDyBzy0AtGyDtCyD0), Ersetzt,[c68a55a27b0ed85e65f56669f60fd828]
PUP.Optional.MySearch.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\mData\user.js, Gut: (), Schlecht: (user_pref("extensions.irmysearch.aflt", "dvd_14_18_ff");), Ersetzt,[193741b6becb39fd79e1dbf4996cc13f]
PUP.Optional.MySearch.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\mData\user.js, Gut: (), Schlecht: (search.aflt", "dvd_14_18_ff");
user_pref("extensions.ir), Ersetzt,[c58bf700d2b7a88e4e0c48871ee75ea2]
PUP.Optional.MySearch.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\mData\user.js, Gut: (), Schlecht: (search.aflt", "dvd_14_18_ff");
user_pref("extension), Ersetzt,[76da1ed90d7c181eeb6f557aed180ef2]
PUP.Optional.MySearch.A, C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\mData\user.js, Gut: (), Schlecht: (irmysearch.aflt", "dvd_14_18_ff");
user_pref("extensions.irmysearch.instlRef", "140305_a");
user_pref("extensions.irmysearch.cr", "1790956217");
user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1Qzuzz0Czzzy0AyD0C0A0CtA0B0AtA0C0CtDtN0D0Tzu0SzzyDtCtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyByBtB0FtDyBzy0AtGyDtCyD0Dt), Ersetzt,[ef611cdb2a5f270f2931606fe61fd42c]

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

deeprybka 14.01.2015 19:59
Ok...und gleich weiter mit den nächsten Schritten! :daumenhoc

HartmutA 14.01.2015 21:24
Code:
# AdwCleaner v4.107 - Bericht erstellt am 14/01/2015 um 21:16:57
# Aktualisiert 07/01/2015 von Xplode
# Database : 2015-01-13.2 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : HARDY - HARDY-PC-NEU
# Gestartet von : C:\Users\HARDY\Desktop\AdwCleaner_4.107.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BitGuard
Ordner Gelöscht : C:\ProgramData\Browser Manager
Ordner Gelöscht : C:\ProgramData\Conduit
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\Uniblue
Ordner Gelöscht : C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Manager
Ordner Gelöscht : C:\Users\HARDY\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\HARDY\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\HARDY\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\HARDY\AppData\Roaming\BabSolution
Ordner Gelöscht : C:\Users\HARDY\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\HARDY\AppData\Roaming\ExpressFiles
Ordner Gelöscht : C:\Users\HARDY\Documents\Optimizer Pro
Ordner Gelöscht : C:\Users\HARDY\Documents\drivergenius
Ordner Gelöscht : C:\Users\HARDY\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cmaiofennmphjldldcpphcechfnnohja
Ordner Gelöscht : C:\Users\HARDY\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aaaalipaokhkccgmgkdglfinfnfhflko
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Windows\System32\drivers\netfilter64.sys
Datei Gelöscht : C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\foxydeal.sqlite
Datei Gelöscht : C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\invalidprefs.js
Datei Gelöscht : C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\BrowserDefender.xml
Datei Gelöscht : C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\zonealarm.xml
Datei Gelöscht : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\6i00jblt.default-1415256746525\user.js
Datei Gelöscht : C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\user.js
Datei Gelöscht : C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\4p2387fc.default\user.js
Datei Gelöscht : C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\mData\user.js
Datei Gelöscht : C:\Users\HARDY\AppData\Local\Comodo\Dragon\User Data\Default\Local Storage\chrome-extension_aaaalipaokhkccgmgkdglfinfnfhflko_0.localstorage

***** [ Tasks ] *****

Task Gelöscht : Express FilesUpdate

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****
Nach dem 2. Wiederstart waren die Prozesse im Task-Manager nicht aufgetaucht.
Im Moment ist auch Ruhe.....
Gruß Hartmut

deeprybka 14.01.2015 21:32
Gut...und weiter mit den nächsten Schritten... :)

HartmutA 14.01.2015 22:06
Code:
Zoek.exe v5.0.0.0 Updated 14-01-2015
Tool run by HARDY on 14.01.2015 at 21:30:16,94.
Microsoft Windows 7 Home Premium  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\HARDY\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

14.01.2015 21:35:55 Zoek.exe System Restore Point Created Succesfully.

==== Empty Folders Check ======================

C:\PROGRA~2\MSXML 4.0 deleted successfully
C:\PROGRA~2\YouTube Song Downloader deleted successfully
C:\PROGRA~2\COMMON~1\SWF Studio deleted successfully
C:\Program Files\Google deleted successfully
C:\Program Files\Intel deleted successfully
C:\Program Files\VideoLAN deleted successfully
C:\PROGRA~3\install_clap deleted successfully
C:\PROGRA~3\mySongBook Player deleted successfully
C:\PROGRA~3\Oracle deleted successfully
C:\PROGRA~3\{09A2FF97-C2BB-43F0-88A9-54C77BF4EF26} deleted successfully
C:\PROGRA~3\{57A1F65A-0C85-4002-9121-DF864126D485} deleted successfully
C:\PROGRA~3\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} deleted successfully
C:\Users\Gast\AppData\Roaming\LastPass deleted successfully
C:\Users\Gast\AppData\Roaming\Windows Live Writer deleted successfully
C:\Users\HARDY\AppData\Roaming\EurekaLog deleted successfully
C:\Users\HARDY\AppData\Roaming\TP deleted successfully
C:\Users\HARDY\AppData\Local\Unity deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2389243879-3189858854-901359939-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6dad39c6-f4ac-4984-8e9b-f666269b9eb1} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-2389243879-3189858854-901359939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully
HKEY_USERS\S-1-5-21-2389243879-3189858854-901359939-1000\Software\Mozilla\Firefox\Extensions\cliqz@cliqz.com deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\virtualKeyboard@kaspersky.ru deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\{23fcfd51-4958-4f00-80a3-ae97e717ed8b} deleted successfully

==== Services(whitelist) ======================
Powered by E Dev

R2 - [AdobeARMservice] - Adobe Acrobat Update Service - c:\program files (x86)\common files\adobe\arm\1.0\armsvc.exe
R2 - [AVP15.0.0] - Kaspersky Anti-Virus Service 15.0.0 - c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe
R2 - [BingDesktopUpdate] - Bing Desktop Update service - c:\program files (x86)\microsoft\bingdesktop\bingdesktopupdater.exe
R2 - [cvhsvc] - Client Virtualization Handler - c:\program files (x86)\common files\microsoft shared\virtualization handler\cvhsvc.exe
R2 - [EPSON_EB_RPCV4_04] - EPSON V5 Service4(04) - c:\program files\common files\epson\epw!3 ssrp\e_s50stb.exe
R2 - [EPSON_PM_RPCV4_04] - EPSON V3 Service4(04) - c:\program files\common files\epson\epw!3 ssrp\e_s50rpb.exe
R2 - [EpsonScanSvc] - Epson Scanner Service - c:\windows\system32\escsvc64.exe
R2 - [IAStorDataMgrSvc] - Intel(R) Rapid Storage Technology - c:\program files (x86)\intel\intel(r) rapid storage technology\iastordatamgrsvc.exe
R2 - [Samsung Link Service] - Samsung Link Service - c:\program files\samsung\samsung link\samsung link.exe
R2 - [sftlist] - Application Virtualization Client - c:\program files (x86)\microsoft application virtualization client\sftlist.exe
R2 - [TuneUp.UtilitiesSvc] - TuneUp Utilities Service - c:\program files (x86)\tuneup utilities 2012\tuneuputilitiesservice64.exe
R2 - [wlidsvc] - Windows Live ID Sign-in Assistant - c:\program files\common files\microsoft shared\windows live\wlidsvc.exe
R2 - [WSearch] - Windows Search - c:\windows\system32\searchindexer.exe
R3 - [ALG] - Gatewaydienst auf Anwendungsebene - c:\windows\system32\alg.exe
R3 - [sftvsa] - Application Virtualization Service Agent - c:\program files (x86)\microsoft application virtualization client\sftvsa.exe
S2 - [clr_optimization_v4.0.30319_32] - Microsoft .NET Framework NGEN v4.0.30319_X86 - c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe
S2 - [clr_optimization_v4.0.30319_64] - Microsoft .NET Framework NGEN v4.0.30319_X64 - c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe
S2 - [sppsvc] - Software Protection - c:\windows\system32\sppsvc.exe
S2 - [ZAPrivacyService] - ZoneAlarm Privacy Service - c:\program files (x86)\checkpoint\zonealarm\zaprivacyservice.exe [x]
S3 - [AdobeFlashPlayerUpdateSvc] - Adobe Flash Player Update Service - c:\windows\syswow64\macromed\flash\flashplayerupdateservice.exe
S3 - [aspnet_state] - ASP.NET-Zustandsdienst - c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe
S3 - [COMSysApp] - COM+-Systemanwendung - c:\windows\system32\dllhost.exe
S3 - [cphs] - Intel(R) Content Protection HECI Service - c:\windows\syswow64\intelcphecisvc.exe
S3 - [ehRecvr] - Windows Media Center-Empfängerdienst - c:\windows\ehome\ehrecvr.exe
S3 - [ehSched] - Windows Media Center-Planerdienst - c:\windows\ehome\ehsched.exe
S3 - [Fax] - Fax - c:\windows\system32\fxssvc.exe
S3 - [FLEXnet Licensing Service] - FLEXnet Licensing Service - c:\program files (x86)\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe
S3 - [FontCache3.0.0.0] - Windows Presentation Foundation-Schriftartcache 3.0.0.0 - c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe
S3 - [gusvc] - Google Updater Service - c:\program files (x86)\google\common\google updater\googleupdaterservice.exe
S3 - [IDriverT] - InstallDriver Table Manager - c:\program files (x86)\common files\installshield\driver\1050\intel 32\idrivert.exe
S3 - [IEEtwCollectorService] - Internet Explorer ETW Collector Service - c:\windows\system32\ieetwcollector.exe
S3 - [MozillaMaintenance] - Mozilla Maintenance Service - c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe
S3 - [MSDTC] - Distributed Transaction Coordinator - c:\windows\system32\msdtc.exe
S3 - [msiserver] - Windows Installer - c:\windows\system32\msiexec.exe
S3 - [ose] - Office  Source Engine - c:\program files (x86)\common files\microsoft shared\source engine\ose.exe
S3 - [osppsvc] - Office Software Protection Platform - c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe
S3 - [PerfHost] - Leistungsindikator-DLL-Host - c:\windows\syswow64\perfhost.exe
S3 - [RpcLocator] - RPC-Locator - c:\windows\system32\locator.exe
S3 - [SNMPTRAP] - SNMP-Trap - c:\windows\system32\snmptrap.exe
S3 - [TrustedInstaller] - Windows Modules Installer - c:\windows\servicing\trustedinstaller.exe
S3 - [vds] - Virtueller Datenträger - c:\windows\system32\vds.exe
S3 - [VSS] - Volumeschattenkopie - c:\windows\system32\vssvc.exe
S3 - [WatAdminSvc] - Windows-Aktivierungstechnologieservice - c:\windows\system32\wat\watadminsvc.exe
S3 - [wbengine] - Blockebenen-Sicherungsmodul - c:\windows\system32\wbengine.exe
S3 - [wmiApSrv] - WMI-Leistungsadapter - c:\windows\system32\wbem\wmiapsrv.exe
S4 - [AdobeActiveFileMonitor11.0] - Adobe Active File Monitor V11 - c:\program files (x86)\adobe\elements 11 organizer\photoshopelementsfileagent.exe
S4 - [AdobeActiveFileMonitor8.0] - Adobe Active File Monitor V8 - c:\program files (x86)\adobe\elements organizer 8.0\photoshopelementsfileagent.exe
S4 - [AllShare Framework DMS] - AllShare Framework DMS - c:\program files\samsung\allshare framework dms\1.3.23\allshareframeworkmanagerdms.exe
S4 - [clr_optimization_v2.0.50727_32] - Microsoft .NET Framework NGEN v2.0.50727_X86 - c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe
S4 - [clr_optimization_v2.0.50727_64] - Microsoft .NET Framework NGEN v2.0.50727_X64 - c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe
S4 - [LMS] - Intel(R) Management and Security Application Local Management Service - c:\program files (x86)\intel\intel(r) management engine components\lms\lms.exe
S4 - [MemeoBackgroundService] - MemeoBackgroundService - c:\program files (x86)\memeo\autobackup\memeobackgroundservice.exe
S4 - [SamsungAllShareV2.0] - Samsung AllShare PC - c:\program files (x86)\samsung\allshare\allsharedms\allsharedms.exe
S4 - [SimpleSlideShowServer] - SimpleSlideShowServer - c:\program files (x86)\samsung\allshare\allshareslideshowservice.exe
S4 - [UNS] - Intel(R) Management and Security Application User Notification Service - c:\program files (x86)\intel\intel(r) management engine components\uns\uns.exe
S4 - [WMPNetworkSvc] - Windows Media Player-Netzwerkfreigabedienst - c:\program files\windows media player\wmpnetwk.exe

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\6i00jblt.default-1415256746525\prefs.js:

Added to C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\6i00jblt.default-1415256746525\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

Deleted from C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js:
user_pref("browser.startup.homepage", "www.startzentrale.de");
user_pref("browser.search.defaultenginename", "Bing");
user_pref("extensions.ORJ-V7C.my-keyword-url", "\"\"");
user_pref("keyword.URL", "");
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\prefs.js:

Deleted from C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\4p2387fc.default\prefs.js:

Added to C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\4p2387fc.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

Deleted from C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\mData\prefs.js:

Added to C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\mData\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\6i00jblt.default-1415256746525

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs__2150_.backup

ProfilePath: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs__2150_.backup

ProfilePath: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\4p2387fc.default

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs__2150_.backup

ProfilePath: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\mData

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs__2150_.backup

==== Deleting Files \ Folders ======================

C:\PROGRA~3\{09A2FF97-C2BB-43F0-88A9-54C77BF4EF26} not found
C:\PROGRA~3\{57A1F65A-0C85-4002-9121-DF864126D485} not found
C:\PROGRA~3\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} not found
C:\PROGRA~2\Mozilla Firefox\extensions\ffxtlbr@babylon.com deleted
C:\PROGRA~2\EvilLyrics deleted
C:\user.js deleted
C:\Users\HARDY\AppData\Roaming\WB.CFG deleted
C:\PROGRA~3\YO1gG4Aky.dat deleted
C:\PROGRA~3\eBay deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\HARDY\AppData\LocalLow\boost_interprocess deleted
C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\Toolbar4 deleted
C:\Windows\wininit.ini deleted
C:\Windows\Syswow64\sho16CD.tmp deleted
C:\Windows\Syswow64\sho1979.tmp deleted
C:\Windows\Syswow64\sho1CB8.tmp deleted
C:\Windows\Syswow64\sho23AE.tmp deleted
C:\Windows\Syswow64\sho23D5.tmp deleted
C:\Windows\Syswow64\sho242F.tmp deleted
C:\Windows\Syswow64\sho256D.tmp deleted
C:\Windows\Syswow64\sho2C49.tmp deleted
C:\Windows\Syswow64\sho327C.tmp deleted
C:\Windows\Syswow64\sho3B10.tmp deleted
C:\Windows\Syswow64\sho3D4E.tmp deleted
C:\Windows\Syswow64\sho4402.tmp deleted
C:\Windows\Syswow64\sho45D5.tmp deleted
C:\Windows\Syswow64\sho4FD4.tmp deleted
C:\Windows\Syswow64\sho51F5.tmp deleted
C:\Windows\Syswow64\sho5564.tmp deleted
C:\Windows\Syswow64\sho55E1.tmp deleted
C:\Windows\Syswow64\sho59E9.tmp deleted
C:\Windows\Syswow64\sho5B38.tmp deleted
C:\Windows\Syswow64\sho5DE7.tmp deleted
C:\Windows\Syswow64\sho6779.tmp deleted
C:\Windows\Syswow64\sho6803.tmp deleted
C:\Windows\Syswow64\sho7453.tmp deleted
C:\Windows\Syswow64\sho7855.tmp deleted
C:\Windows\Syswow64\sho78EA.tmp deleted
C:\Windows\Syswow64\sho7B16.tmp deleted
C:\Windows\Syswow64\sho81C8.tmp deleted
C:\Windows\Syswow64\sho8A75.tmp deleted
C:\Windows\Syswow64\sho8C77.tmp deleted
C:\Windows\Syswow64\sho8E1E.tmp deleted
C:\Windows\Syswow64\sho984B.tmp deleted
C:\Windows\Syswow64\shoA1CE.tmp deleted
C:\Windows\Syswow64\shoA3DD.tmp deleted
C:\Windows\Syswow64\shoA5AF.tmp deleted
C:\Windows\Syswow64\shoA5E0.tmp deleted
C:\Windows\Syswow64\shoA872.tmp deleted
C:\Windows\Syswow64\shoAE97.tmp deleted
C:\Windows\Syswow64\shoB51A.tmp deleted
C:\Windows\Syswow64\shoB56A.tmp deleted
C:\Windows\Syswow64\shoCC4A.tmp deleted
C:\Windows\Syswow64\shoDC44.tmp deleted
C:\Windows\Syswow64\shoDCDD.tmp deleted
C:\Windows\Syswow64\shoDE1B.tmp deleted
C:\Windows\Syswow64\shoDEEC.tmp deleted
C:\Windows\Syswow64\shoE3AF.tmp deleted
C:\Windows\Syswow64\shoEC6D.tmp deleted
C:\Windows\Syswow64\shoF21A.tmp deleted
C:\Windows\Syswow64\shoFFDC.tmp deleted
C:\Windows\Syswow64\InstallUtil.InstallLog deleted
C:\Windows\SysWow64\searchplugins deleted
C:\Windows\SysWow64\Extensions deleted
C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\search_engine.xml deleted
C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\foxydeal.json deleted
C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\aoldeToolbarData deleted
C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\jetpack deleted
C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\CT3297265 deleted
C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\4p2387fc.default\extensions\staged deleted
C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\mData\extensions\staged deleted
C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\extensions\youtubeunblocker@unblocker.yt deleted
C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\smartbar deleted
"C:\Windows\Installer\deb1db.msi" deleted

==== System Specs ======================

Windows: Windows 7 Home Premium Edition (64-bit) Service Pack 1 (Build 7601)
Memory (RAM): 3976 MB
CPU Info: Intel(R) Pentium(R) CPU G630 @ 2.70GHz
CPU Speed: 2706,4 MHz
Sound Card: Lautsprecher (Realtek High Defi |
Display Adapters: Intel(R) HD Graphics | Intel(R) HD Graphics | RDPDD Chained DD | RDP Encoder Mirror Driver | RDP Reflector Display Driver
Monitors: 1x; BenQ M2200HD D-SUB |
Screen Resolution: 1920 X 1080 - 32 bit
Network: Network Present
Network Adapters: Microsoft Virtual WiFi Miniport Adapter | Realtek PCIe GBE Family Controller | Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Network Adapter
CD / DVD Drives: 1x (E: | ) E: TSSTcorpCDDVDW SH-216AB
Ports: COM4 LPT Port NOT Present.
Mouse: 16 Button Wheel Mouse Present
Hard Disks: C:  414,7GB | D:  50,0GB | Q:  0,0MB
Hard Disks - Free: C:  18,0GB | D:  16,8GB | Q:  0,0MB
Manufacturer *: American Megatrends Inc.
BIOS Info: AT/AT COMPATIBLE | 03/08/12 | MEDION - 7292010
Time Zone: Mitteleuropäische Zeit
Motherboard *: MEDIONPC MS-7728
Country: Deutschland
Language: DEU

==== System Specs (Software) ======================

Anti-Virus: Kaspersky Internet Security On-access scanning disabled (Outdated)
Anti-Spyware: Kaspersky Internet Security disabled (Outdated)
Anti-Spyware: Windows Defender disabled (Outdated)
Firewall: Kaspersky Internet Security disabled
Default Browser: Firefox        35.0
Internet Explorer Version: 11.0.9600.17501
Mozilla Firefox version: 29.0.1 (x86 de)
Mozilla Firefox version: 30.0 (x86 de)
Mozilla Firefox version: 35.0 (x86 de)
Adobe Reader version: 11.0.10.32
Sun Java version: 1.7.0_09 (64-bit)
Flash Player version: 16.0.0.257
Shockwave Player version: 12.1.3r153

==== Files Recently Created / Modified ======================

====== C:\Windows ====
====== C:\Users\HARDY\AppData\Local\Temp ====
2015-01-10 07:02:27        645C4C1FB69DEE076489FC87B4FC6A71        33128716        ----a-w-        C:\Users\HARDY\AppData\Local\Temp\aaccee\aabbcc.exe
====== Java Cache =====
====== C:\Windows\SysWOW64 =====
====== C:\Windows\SysWOW64\drivers =====
====== C:\Windows\Sysnative =====
====== C:\Windows\Sysnative\drivers =====
2015-01-14 18:12:10        26C43960C99EE861A5D0EDC4DCF3B1C3        129752        ----a-w-        C:\Windows\Sysnative\drivers\MBAMSwissArmy.sys
2015-01-14 18:11:16        CA43F8904E24BBE49982E4C0B29E6579        25816        ----a-w-        C:\Windows\Sysnative\drivers\mbam.sys
2015-01-14 18:11:16        A646C2DDB8C46E9B20A326FAF566646C        63704        ----a-w-        C:\Windows\Sysnative\drivers\mwac.sys
2015-01-14 18:11:16        478CC94C937D235CB0A96AB8F2359D81        93400        ----a-w-        C:\Windows\Sysnative\drivers\mbamchameleon.sys
====== C:\Windows\Tasks ======
2015-01-13 05:08:09        C1694555F46344B831D3FF3A1781E790        3026        ----a-w-        C:\Windows\Sysnative\Tasks\{505E1B58-5E96-4D62-BF85-AA982B1E160F}
2015-01-13 05:07:56        C1694555F46344B831D3FF3A1781E790        3026        ----a-w-        C:\Windows\Sysnative\Tasks\{3C9A141B-419D-4002-A2CA-2159148DB79E}
2015-01-13 05:07:56        C1694555F46344B831D3FF3A1781E790        3026        ----a-w-        C:\Windows\Sysnative\Tasks\{20982DC0-A7D6-4D10-B57C-E7F4DAD29F14}
2014-12-26 08:56:58        B63AD96D5AB77552EFDB7D2277C3B0CB        3886        ----a-w-        C:\Windows\Sysnative\Tasks\Adobe Acrobat Update Task
====== C:\Windows\Temp ======
======= C:\Program Files =====
======= C:\PROGRA~2 =====
======= C: =====
2015-01-13 05:30:16        D41D8CD98F00B204E9800998ECF8427E        0        ----a-w-        C:\autoexec.bat
====== C:\Users\HARDY\AppData\Roaming ======
2015-01-10 07:04:55        --------        d-----w-        C:\Users\Default\AppData\Roaming\Adobe
2015-01-10 07:04:55        --------        d-----w-        C:\Users\Default User\AppData\Roaming\Adobe
2015-01-10 07:02:36        --------        d-----w-        C:\Users\Default\AppData\Local\Programs
2015-01-10 07:02:36        --------        d-----w-        C:\Users\Default User\AppData\Local\Programs
====== C:\Users\HARDY ======
2015-01-14 17:58:49        61CA40317EBF1254770BF8B495B3F8DA        2191360        ----a-w-        C:\Users\HARDY\Desktop\AdwCleaner_4.107.exe
2015-01-14 17:50:49        3BD59D6C407AB1F6DDD7C5D9BD727469        20447072        ----a-w-        C:\Users\HARDY\Desktop\mbam-setup-2.0.4.1028.exe
2015-01-14 17:38:13        3BD59D6C407AB1F6DDD7C5D9BD727469        20447072        ----a-w-        C:\Users\HARDY\Download\mbam-setup-2.0.4.1028.exe
2015-01-14 15:50:56        63BC47D1184B92BBAE42654E355E8DF7        2124288        ----a-w-        C:\Users\HARDY\Desktop\FRST64.exe

====== C: exe-files ==
2015-01-14 18:08:17        2F0B1C820168997CA67E54B9C22D9F56        544        ----a-w-        C:\$RECYCLE.BIN\S-1-5-21-2389243879-3189858854-901359939-1000\$IXQUYXQ.exe
2015-01-14 17:58:49        61CA40317EBF1254770BF8B495B3F8DA        2191360        ----a-w-        C:\Users\HARDY\Desktop\AdwCleaner_4.107.exe
2015-01-14 17:50:49        3BD59D6C407AB1F6DDD7C5D9BD727469        20447072        ----a-w-        C:\Users\HARDY\Desktop\mbam-setup-2.0.4.1028.exe
2015-01-14 17:44:48        55DEC4F879F4A75A38C840D85F6B6365        544        ----a-w-        C:\$RECYCLE.BIN\S-1-5-21-2389243879-3189858854-901359939-1000\$IL2F9YQ.exe
2015-01-14 17:43:23        3BD59D6C407AB1F6DDD7C5D9BD727469        20447072        ----a-w-        C:\$RECYCLE.BIN\S-1-5-21-2389243879-3189858854-901359939-1000\$RXQUYXQ.exe
2015-01-14 17:38:13        3BD59D6C407AB1F6DDD7C5D9BD727469        20447072        ----a-w-        C:\Users\HARDY\Download\mbam-setup-2.0.4.1028.exe
2015-01-14 15:50:56        63BC47D1184B92BBAE42654E355E8DF7        2124288        ----a-w-        C:\Users\HARDY\Desktop\FRST64.exe
2015-01-14 08:07:01        7E5A3BDDB5E722BD1691F808B36E292B        1169920        ----a-w-        C:\Windows\Temp\db22.exe
2015-01-13 05:26:53        B4CD9E8513C17C32224C70330A235296        3044736        ----a-w-        C:\$RECYCLE.BIN\S-1-5-21-2389243879-3189858854-901359939-1000\$RL2F9YQ.exe
2015-01-12 17:48:18        516A5FCE06BB388499238A5F9286CB74        96768        ----a-w-        C:\Windows\Temp\7454F746-ADB6-4F27-9A6D-E29ED6AEBE82\DismHost.exe
2015-01-10 07:02:29        645C4C1FB69DEE076489FC87B4FC6A71        33128716        ----a-w-        C:\Windows\Temp\aaccee\aabbcc.exe
2015-01-10 07:02:27        645C4C1FB69DEE076489FC87B4FC6A71        33128716        ----a-w-        C:\Users\HARDY\AppData\Local\Temp\aaccee\aabbcc.exe
=== C: other files ==
2015-01-14 18:12:10        26C43960C99EE861A5D0EDC4DCF3B1C3        129752        ----a-w-        C:\Windows\System32\drivers\MBAMSwissArmy.sys
2015-01-14 18:11:16        CA43F8904E24BBE49982E4C0B29E6579        25816        ----a-w-        C:\Windows\System32\drivers\mbam.sys
2015-01-14 18:11:16        A646C2DDB8C46E9B20A326FAF566646C        63704        ----a-w-        C:\Windows\System32\drivers\mwac.sys
2015-01-14 18:11:16        478CC94C937D235CB0A96AB8F2359D81        93400        ----a-w-        C:\Windows\System32\drivers\mbamchameleon.sys
2015-01-13 05:30:16        D41D8CD98F00B204E9800998ECF8427E        0        ----a-w-        C:\autoexec.bat
2015-01-12 09:25:34        BC143A4B1DBE3B467E9A8F609E43D4BC        72375035        ----a-w-        C:\ProgramData\Kaspersky Lab\KAV.15.0.0.463b_01.12_10.25_1748.dump.zip

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\6i00jblt.default-1415256746525
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\4p2387fc.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\mData
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"online_banking@kaspersky.com"="C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com" [08.10.2014 09:11]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\6i00jblt.default-1415256746525
- Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
- Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
- Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
- Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
- Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
- Undetermined - content_blocker@kaspersky.com
- Undetermined - virtual_keyboard@kaspersky.com
- Undetermined - anti_banner@kaspersky.com
- Undetermined - online_banking@kaspersky.com

ProfilePath: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406
- Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
- Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
- Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
- Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
- Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
- Undetermined - {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
- Undetermined - DailymotionVideoDownloader@PeterOlayev.com
- Undetermined - support@lastpass.com
- Undetermined - facebook-translate@oliver.schloebe.de
- Undetermined - amznUWL2@amazon.com
- Undetermined - content_blocker@kaspersky.com
- Undetermined - virtual_keyboard@kaspersky.com
- Undetermined - url_advisor@kaspersky.com
- Undetermined - anti_banner@kaspersky.com
- Undetermined - online_banking@kaspersky.com
- Undetermined - {d49175b3-3fd8-43b8-b28e-da5d47f3c398}
- Undetermined - {9AA46F4F-4DC7-4c06-97AF-5035170634FE}
- Undetermined - fb_add_on@avm.de
- Undetermined - %ProfilePath%\extensions\a7dcbdf436c4877351b4433f56018c55cf09ba4f4deab9748ce6f9f335db1d34_lp.key
- Undetermined - %ProfilePath%\extensions\a7dcbdf436c4877351b4433f56018c55cf09ba4f4deab9748ce6f9f335db1d34_lp.key
- Facebook Translate - %ProfilePath%\extensions\facebook-translate@oliver.schloebe.de
- FRITZBox AddOn - %ProfilePath%\extensions\fb_add_on@avm.de
- LastPass - %ProfilePath%\extensions\support@lastpass.com
- Evernote Web Clipper - %ProfilePath%\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
- Botn de Aadir a la lista de deseos Amazon > - %ProfilePath%\extensions\amznUWL2@amazon.com.xpi
- 1-Click Dailymotion Video Downloader - %ProfilePath%\extensions\DailymotionVideoDownloader@PeterOlayev.com.xpi
- Element Hiding Helper for Adblock Plus - %ProfilePath%\extensions\elemhidehelper@adblockplus.org.xpi
- Facebook Privacy Watcher - %ProfilePath%\extensions\fpw@informatik.tu-darmstadt.de.xpi
- ProxTube - Gesperrte YouTube Videos entsperren - %ProfilePath%\extensions\ich@maltegoetz.de.xpi
- PAYBACK Internet Assistent fuer Firefox - %ProfilePath%\extensions\toolbar-ff@payback.de.xpi
- Youtube and more - Easy Video Downloader - %ProfilePath%\extensions\vdpure@link64.xpi
- YouTube Smart Pause - %ProfilePath%\extensions\YouTubeSmartPause@jetpack.xpi
- Facebook Phishing Protector - %ProfilePath%\extensions\{023e9ca0-63f3-47b1-bcb2-9badf9d9ef28}.xpi
- ImTranslator - %ProfilePath%\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
- BetterPrivacy - %ProfilePath%\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
- COMPUTERBILD-Abzockschutz - %ProfilePath%\extensions\{d49175b3-3fd8-43b8-b28e-da5d47f3c398}.xpi
- fdf74615-70a3-4ee2-8c01-83e275e40e39 - %ProfilePath%\extensions\{fdf74615-70a3-4ee2-8c01-83e275e40e39}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Anti-Banner - %AppDir%\extensions\KavAntiBanner@kaspersky.ru_bak2
- Modul zur Link-Untersuchung - %AppDir%\extensions\linkfilter@kaspersky.ru_bak2
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406
8560995C727974F27F2A1CE68909FEB9        - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll -        Shockwave Flash
DCB0BCEF594E2C410793C4A823C318F3        - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll -        Shockwave for Director / Shockwave for Director
95812430959AE88CDD0301AB3A71913B        - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll -        Shockwave Flash
87132527E2256CF6683A18C4EB34DD3B        - C:\Windows\system32\Wat\npWatWeb.dll -        Windows Activation Technologies


==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
clbfjfbnelcflpgpklppgplejolacbej - C:\Program Files (x86)\BrowserCompanion\blabbers-ch.crx[]
dbhjdbfgekjfcfkkfjjmlmojhbllhbho - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho[]
nneajnkjbffgblleaoojgaacokifdkhm - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx[]

Comodo Drag&Drop Service - HARDY\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aneodkojaglhnkkdbbdnmmmgimlcaogo
Comodo Web Inspector - HARDY\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bdngekjahnmlkinegnhdmmbcfnmbclnn
Comodo Media Downloader - HARDY\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\dihmnpngfonlhjmgkflpnibiaaliendo

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Backup.Old.Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.aldi.com"
"Search Bar"="hxxp://www.google.com/ie"
"Default_Search_URL"="hxxp://www.google.com/ie"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
@="hxxp://www.google.com/search?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="hxxp://www.google.com/ie"
"Default_Search_URL"="hxxp://www.google.com/ie"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Backup.Old.Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google  Url="hxxp://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{09BD00B8-DDA7-24C1-5D85-6AAB56BD300D} Google  Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MDNE_enDE393"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7"

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4F0EED28BD8194C4984AB0EE5479FD54 deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\clbfjfbnelcflpgpklppgplejolacbej deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\nneajnkjbffgblleaoojgaacokifdkhm deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{82DEE0F4-18DB-4C49-89A4-0BEE4597DF45} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\4F0EED28BD8194C4984AB0EE5479FD54 deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Gast\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Gast\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\HARDY\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\HARDY\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\HARDY\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\HARDY\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Gast\AppData\Local\Mozilla\Firefox\Profiles\6i00jblt.default-1415256746525\cache2 emptied successfully
C:\Users\HARDY\AppData\Local\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\cache2 emptied successfully
C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\personas\cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\HARDY\AppData\Local\Comodo\Dragon\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=1829 folders=268 75904543 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Gast\AppData\Local\Temp emptied successfully
C:\Users\HARDY\AppData\Local\Temp will be emptied at reboot
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\HARDY\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 14.01.2015 at 22:06:01,27 ======================

deeprybka 14.01.2015 22:10
Und Schritt 4 ...:daumenhoc

HartmutA 15.01.2015 07:00
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-01-2015 01
Ran by HARDY (administrator) on HARDY-PC-NEU on 14-01-2015 22:13:34
Running from C:\Users\HARDY\Desktop
Loaded Profiles: HARDY (Available profiles: HARDY & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Copyright 2013 SAMSUNG) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
(Copyright 2013 SAMSUNG) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Copyright 2013 SAMSUNG) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
(Blue Onion Software) C:\Program Files (x86)\Blue Onion Software\DeskDrive\DeskDrive.exe
(J3S GmbH) C:\Program Files (x86)\COMPUTER BILD Account-Alarm\COMPUTER BILD Account-Alarm.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDExtHost.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDAppHost.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDRuntimeHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Samsung Link] => C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe [607584 2014-12-16] (Copyright 2013 SAMSUNG)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2353880 2013-11-01] (Microsoft Corp.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Run: [DeskDriveStartup] => C:\Program Files (x86)\Blue Onion Software\DeskDrive\DeskDrive.exe [66048 2012-02-08] (Blue Onion Software)
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Run: [COMPUTER BILD Account-Alarm] => C:\Program Files (x86)\COMPUTER BILD Account-Alarm\COMPUTER BILD Account-Alarm.exe [2058752 2014-08-07] (J3S GmbH)
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Run: [Adobe Reader Synchronizer] => C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AdobeCollabSync.exe [761064 2014-12-03] (Adobe Systems Incorporated)
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk
ShortcutTarget: Install LastPass IE RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe (LastPass)
Startup: C:\Users\HARDY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\HARDY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2389243879-3189858854-901359939-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM-x32 -> Backup.Old.DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> Backup.Old.DefaultScope {9C1561B1-7036-483F-AF30-0CB0BACFD918}
SearchScopes: HKU\S-1-5-21-2389243879-3189858854-901359939-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: CBAbzockschutz.InitToolbarBHO -> {2e250b90-0e7a-42a3-9d65-e39f9f227fa4} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} ->  No File
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
Toolbar: HKLM-x32 - COMPUTERBILD-Abzockschutz - {353e2a48-6254-4bd3-88f4-3b51a0ca7870} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {B07F54E6-0806-47DB-B5D8-398F240776F2} file:///E:/viewer/ORDcmViewCD.ocx
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406
FF DefaultSearchEngine: Bing
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll No File
FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll (LastPass)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll No File
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass.dll (LastPass)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKU\.DEFAULT: samsung.com/SamsungLinkPCPlugin -> C:\Program Files\Samsung\Samsung Link\utils\npSamsungLinkPCPlugin.dll No File
FF Plugin HKU\S-1-5-21-2389243879-3189858854-901359939-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\HARDY\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll No File
FF user.js: detected! => C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\user.js
FF user.js: detected! => C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-2389243879-3189858854-901359939-1000\FireFox\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\aol-suche.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\chordie.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\firefox-add-ons.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\idealode.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\podcastde.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\qrobeit.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\webwebweb---by-easy-video-downloader.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\youtube-videosuche.xml
FF SearchPlugin: C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\searchplugins\youtube.xml
FF Extension: Facebook Translate - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\facebook-translate@oliver.schloebe.de [2014-04-06]
FF Extension: FRITZ!Box AddOn - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\fb_add_on@avm.de [2014-11-27]
FF Extension: LastPass - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\support@lastpass.com [2014-03-21]
FF Extension: Evernote Web Clipper - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800} [2014-07-24]
FF Extension: Add to Amazon Wish List Button - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\amznUWL2@amazon.com.xpi [2014-07-24]
FF Extension: 1-Click Dailymotion Video Downloader - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\DailymotionVideoDownloader@PeterOlayev.com.xpi [2013-10-31]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\elemhidehelper@adblockplus.org.xpi [2012-10-11]
FF Extension: Facebook Privacy Watcher - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\fpw@informatik.tu-darmstadt.de.xpi [2014-10-08]
FF Extension: ProxTube - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\ich@maltegoetz.de.xpi [2014-09-11]
FF Extension: PAYBACK Internet Assistent fuer Firefox - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\toolbar-ff@payback.de.xpi [2014-11-20]
FF Extension: Youtube and more - Easy Video Downloader - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\vdpure@link64.xpi [2014-12-07]
FF Extension: YouTube Smart Pause - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\YouTubeSmartPause@jetpack.xpi [2013-09-11]
FF Extension: Facebook Phishing Protector - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{023e9ca0-63f3-47b1-bcb2-9badf9d9ef28}.xpi [2013-02-11]
FF Extension: ImTranslator - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2012-10-10]
FF Extension: Adblock Plus - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-10-10]
FF Extension: BetterPrivacy - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2013-08-23]
FF Extension: COMPUTERBILD-Abzockschutz - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{d49175b3-3fd8-43b8-b28e-da5d47f3c398}.xpi [2012-10-17]
FF Extension: {fdf74615-70a3-4ee2-8c01-83e275e40e39} - C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\Extensions\{fdf74615-70a3-4ee2-8c01-83e275e40e39}.xpi [2013-10-30]
FF Extension: LastPass - C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-2389243879-3189858854-901359939-1000\FireFox\Extensions\support@lastpass.com [2013-11-07]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2015-01-13]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2015-01-13]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Ngăn chặn trang web nguy hiểm - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-08-30]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Bàn phím ảo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-30]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Công cụ kiểm tra liên kết của Kaspersky - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-08-30]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-08-30]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: An toàn giao dịch tài chính - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-08-30]
FF HKU\.DEFAULT\...\Firefox\Extensions: [{b64982b1-d112-42b5-b1e4-d3867c4533f8}] - C:\ProgramData\Browser Manager\2.2.643.41\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-17] (Adobe Systems Incorporated)
S4 AllShare Framework DMS; C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe [404360 2013-12-21] (Samsung) [File not signed]
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3645432 2014-07-18] (devolo AG)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link.exe [616288 2014-12-16] (Copyright 2013 SAMSUNG)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2143072 2012-05-29] (TuneUp Software)
S3 x10nets; C:\Program Files (x86)\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed]
S2 ZAPrivacyService; "C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AF9035BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [513600 2009-11-05] (ITETech                  )
R3 azvusb; C:\Windows\System32\DRIVERS\azvusb.sys [54784 2009-08-13] (AzureWave Technologies, Inc.)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-07-18] () [File not signed]
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-08] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-08] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 L6UX2; C:\Windows\System32\Drivers\L6UX264.sys [772864 2013-07-11] (Line 6)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2014-07-18] (CACE Technologies)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-05-08] (TuneUp Software)
S3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [33048 2006-11-30] (X10 Wireless Technology, Inc.)
S3 ysusb64; C:\Windows\System32\drivers\ysusb64.sys [132200 2013-12-17] (Yamaha Corporation)
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-14 22:13 - 2015-01-14 22:14 - 00026724 _____ () C:\Users\HARDY\Desktop\FRST.txt
2015-01-14 22:13 - 2015-01-14 22:13 - 00000000 ____D () C:\Users\HARDY\Desktop\FRST-OlderVersion
2015-01-14 22:06 - 2015-01-14 22:06 - 00001194 _____ () C:\Users\HARDY\Desktop\Boot (C).lnk
2015-01-14 22:03 - 2015-01-14 21:30 - 00024064 _____ () C:\Windows\zoek-delete.exe
2015-01-14 21:35 - 2015-01-14 22:06 - 00034224 _____ () C:\zoek-results.log
2015-01-14 21:30 - 2015-01-14 21:51 - 00000000 ____D () C:\zoek_backup
2015-01-14 20:02 - 2015-01-14 21:31 - 00000000 ____D () C:\AdwCleaner
2015-01-14 19:12 - 2015-01-14 19:58 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-14 19:11 - 2015-01-14 19:11 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-14 19:11 - 2015-01-14 19:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-14 19:11 - 2015-01-14 19:11 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-14 19:11 - 2015-01-14 19:11 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-14 19:11 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-14 19:11 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-14 19:11 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-14 18:59 - 2015-01-14 18:59 - 01295360 _____ () C:\Users\HARDY\Desktop\zoek.exe
2015-01-14 18:58 - 2015-01-14 18:58 - 02191360 _____ () C:\Users\HARDY\Desktop\AdwCleaner_4.107.exe
2015-01-14 18:50 - 2015-01-14 18:38 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\HARDY\Desktop\mbam-setup-2.0.4.1028.exe
2015-01-14 16:51 - 2015-01-14 22:13 - 00000000 ____D () C:\FRST
2015-01-14 16:50 - 2015-01-14 22:13 - 02125312 _____ (Farbar) C:\Users\HARDY\Desktop\FRST64.exe
2015-01-13 19:11 - 2015-01-13 19:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-13 06:30 - 2015-01-13 06:30 - 00000000 _____ () C:\autoexec.bat
2015-01-13 06:08 - 2015-01-13 06:08 - 00003026 _____ () C:\Windows\System32\Tasks\{505E1B58-5E96-4D62-BF85-AA982B1E160F}
2015-01-13 06:07 - 2015-01-13 06:07 - 00003026 _____ () C:\Windows\System32\Tasks\{3C9A141B-419D-4002-A2CA-2159148DB79E}
2015-01-13 06:07 - 2015-01-13 06:07 - 00003026 _____ () C:\Windows\System32\Tasks\{20982DC0-A7D6-4D10-B57C-E7F4DAD29F14}
2015-01-10 08:04 - 2015-01-10 08:04 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-01-10 08:04 - 2015-01-10 08:04 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Adobe
2015-01-10 08:04 - 2015-01-10 08:04 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-01-10 08:04 - 2015-01-10 08:04 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Adobe
2015-01-08 21:01 - 2015-01-08 21:01 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat
2015-01-03 11:32 - 2015-01-03 11:32 - 00000857 _____ () C:\Users\HARDY\Desktop\Guitar Explorer.lnk
2014-12-26 09:56 - 2014-12-26 09:56 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2014-12-20 06:54 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-20 06:54 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-15 12:24 - 2014-12-15 12:24 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-15 09:05 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-15 09:05 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-15 09:05 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-15 09:05 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-15 09:05 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-15 09:05 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-15 09:05 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-15 09:05 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-15 09:05 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-15 09:05 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-15 09:05 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-15 09:05 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-15 09:05 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-15 09:05 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-15 09:05 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-15 09:05 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-15 09:05 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-15 09:05 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-12-15 09:05 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-12-15 09:05 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-12-15 09:05 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-12-15 09:05 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2014-12-15 09:05 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2014-12-15 09:05 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2014-12-15 09:05 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2014-12-15 09:04 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-15 09:04 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-15 09:04 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-15 09:04 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-15 09:04 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-15 09:04 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-15 09:04 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-15 09:04 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-15 09:04 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-15 09:04 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-15 09:04 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-15 09:04 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-15 09:04 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-15 09:04 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-15 09:04 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-15 09:04 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-15 09:04 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-15 09:04 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-15 09:04 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-15 09:04 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-15 09:04 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-15 09:04 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-15 09:04 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-15 09:04 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-15 09:04 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-15 09:04 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-15 09:04 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-15 09:04 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-15 09:04 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-15 09:04 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-15 09:04 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-15 09:04 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-15 09:04 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-15 09:04 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-15 09:04 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-15 09:04 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-15 09:04 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-15 09:04 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-15 09:04 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-15 09:04 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-15 09:04 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-15 09:04 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-15 09:04 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-15 09:04 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-15 09:04 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-15 09:04 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-15 09:04 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-15 09:04 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-15 09:04 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-15 09:04 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-15 09:04 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-15 09:04 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-15 09:04 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-15 09:04 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-14 22:12 - 2009-07-14 05:45 - 00024800 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-14 22:12 - 2009-07-14 05:45 - 00024800 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-14 22:08 - 2012-06-20 19:39 - 01048636 _____ () C:\Windows\WindowsUpdate.log
2015-01-14 22:05 - 2014-11-25 09:37 - 00000439 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-01-14 22:05 - 2012-09-18 11:55 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-14 22:04 - 2014-07-19 07:14 - 00053684 _____ () C:\Windows\PFRO.log
2015-01-14 22:04 - 2014-07-01 07:04 - 00061359 _____ () C:\Windows\setupact.log
2015-01-14 22:04 - 2013-03-06 16:24 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-01-14 22:04 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-14 21:48 - 2014-10-15 09:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-14 19:49 - 2014-03-02 04:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-14 19:49 - 2012-12-31 09:39 - 00000000 ____D () C:\Windows\pss
2015-01-14 19:38 - 2013-03-21 15:49 - 00000000 ____D () C:\Users\HARDY\Programme ect
2015-01-14 19:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-01-14 19:08 - 2013-02-20 09:38 - 00000000 ____D () C:\Users\HARDY\Download
2015-01-14 19:07 - 2012-06-21 08:39 - 00000000 ____D () C:\Users\HARDY\AppData\Roaming\MediaMonkey
2015-01-14 18:58 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-01-14 18:56 - 2011-05-16 15:04 - 00700612 _____ () C:\Windows\system32\perfh007.dat
2015-01-14 18:56 - 2011-05-16 15:04 - 00150494 _____ () C:\Windows\system32\perfc007.dat
2015-01-14 18:56 - 2009-07-14 06:13 - 01624592 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-14 18:42 - 2014-01-27 12:54 - 00000000 ____D () C:\Users\HARDY\AppData\Roaming\vlc
2015-01-14 15:33 - 2013-11-22 11:13 - 00000000 ____D () C:\Users\HARDY\MEDION NAS TOOL
2015-01-14 14:48 - 2014-10-15 09:49 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-14 14:48 - 2013-07-16 18:38 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-14 14:48 - 2013-03-07 16:44 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-14 13:27 - 2009-07-14 05:45 - 00384816 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-13 06:08 - 2014-12-03 07:37 - 00000227 _____ () C:\Windows\SysWOW64\debug.log
2015-01-12 14:44 - 2014-07-18 08:55 - 00000000 ____D () C:\Users\HARDY\AppData\Roaming\AllDup
2015-01-12 14:43 - 2014-07-18 08:55 - 00000000 ____D () C:\ProgramData\AllDup
2015-01-12 14:17 - 2014-03-03 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Genius Professional Edition
2015-01-12 11:42 - 2013-10-06 07:08 - 00000000 ____D () C:\Users\Gast
2015-01-12 11:42 - 2012-06-20 11:52 - 00000000 ___RD () C:\Users\HARDY
2015-01-12 11:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2015-01-12 11:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-01-09 21:19 - 2014-09-16 21:46 - 00032768 _____ () C:\Windows\system32\persistent_q.db-shm
2015-01-05 19:12 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-03 11:32 - 2014-09-14 13:52 - 00000857 _____ () C:\Users\Gast\Desktop\Guitar Explorer.lnk
2014-12-27 11:16 - 2013-09-20 15:42 - 00000000 ___RD () C:\Users\HARDY\Desktop\GITARREN-PROG
2014-12-24 09:32 - 2012-06-21 16:36 - 00000000 ____D () C:\Users\HARDY\AppData\Roaming\SoftGrid Client
2014-12-18 09:50 - 2014-05-24 08:39 - 00000000 ____D () C:\Users\HARDY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Samsung
2014-12-18 09:50 - 2012-06-23 12:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2014-12-16 09:31 - 2012-11-11 12:11 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-15 17:16 - 2014-11-25 07:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\mySongBook Player
2014-12-15 17:16 - 2014-11-25 07:36 - 00000000 ____D () C:\Program Files (x86)\mySongBook Player
2014-12-15 13:50 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-15 12:24 - 2014-04-24 12:35 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-15 12:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-15 09:15 - 2013-08-15 09:20 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-15 09:06 - 2011-07-18 21:31 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-15 08:59 - 2012-06-21 11:19 - 00000000 ____D () C:\Users\HARDY\AppData\Local\Adobe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-01-2015 01
Ran by HARDY at 2015-01-14 22:14:57
Running from C:\Users\HARDY\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

deeprybka 15.01.2015 11:05
Hi,
bitte die Addition.txt komplett posten... :)

HartmutA 15.01.2015 12:24
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-01-2015
Ran by HARDY at 2015-01-15 12:27:27
Running from C:\Users\HARDY\Desktop\FRST-OlderVersion
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

120GuitarChords (HKLM-x32\...\120GuitarChords) (Version:  - NeonWay)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
AC3Filter 2.6.0b (HKLM-x32\...\AC3Filter_is1) (Version: 2.6.0b - Alexander Vigovsky)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Photoshop Elements 11 (HKLM-x32\...\Adobe Photoshop Elements 11) (Version: 11.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 8.0 (HKLM-x32\...\Adobe Photoshop Elements 8.0) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5.3 64-bit (HKLM\...\{2DD71ACB-552D-402C-9529-7906ACB95C30}) (Version: 5.3.1 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
AllShare Framework DMS (HKLM\...\{83232C27-8C3F-44A5-9EB2-BB7161228ADD}) (Version: 1.3.23 - Samsung)
Amazon Cloud Player (HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Amazon Amazon Cloud Player) (Version: 2.4.0.26 - Amazon Services LLC)
Anleitung für Epson Connect (HKLM-x32\...\Epson Connect Guide) (Version:  - )
AntiBrowserSpy (HKLM-x32\...\{F78B5B4F-075A-4C81-AA27-E707861EB5B7}_is1) (Version: 3.6.108 - Abelssoft)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.12.9.0 - Asmedia Technology)
Audacity 2.0.2 (HKLM-x32\...\Audacity_is1) (Version: 2.0.2 - Audacity Team)
AVM FRITZ!Box Dokumentation (HKLM-x32\...\AVMFBox) (Version:  - AVM Berlin)
AVM FRITZ!Box Druckeranschluss (HKLM-x32\...\AVMFBoxPrinter) (Version:  - AVM Berlin)
Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.347.0 - Microsoft Corporation)
Cinergy HTC Stick V5.09.1202.00 (HKLM-x32\...\Cinergy HTC Stick) (Version: 5.09.1202.00 - )
COMPUTER BILD Account-Alarm (HKLM-x32\...\{04B0A9F1-070A-4C32-A575-6D2DC8F5C52E}) (Version: 1.0.3 - J3S)
COMPUTERBILD-Abzockschutz (HKLM-x32\...\{8AA87888-D4A2-4CA2-BAEC-7759D0AD8E38}) (Version: 1.0.43 - J3S)
Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
Covermanager (HKLM-x32\...\Covermanager_is1) (Version: 1.5.0 - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Das große Franzis Paket Office - Office Vorlagen Teil 1 (HKLM-x32\...\Das große Franzis Paket Office - Office Vorlagen Teil 1_is1) (Version:  - )
DeskDrive Version 1.8.5 (HKLM-x32\...\{840CAC48-BDE6-490C-AA34-904E10AB1261}_is1) (Version: 1.8.5 - Blue Onion Software)
devolo Cockpit (HKLM-x32\...\dlancockpit) (Version: 4.2.3.0 - devolo AG)
DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
dLAN Cockpit (x32 Version: 3.2.28 - devolo AG) Hidden
Dropbox (HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
DVDFab Version 8.0.2.2 (HKLM-x32\...\{616FEB8D-CA05-49F4-A155-B74F8DB38B7A}_is1) (Version: 8.0.2.2 - DVDFab 8.0.2.2 Preactivado - Dimitry)
Elements 11 Organizer (x32 Version: 11.0 - Ihr Firmenname) Hidden
Epson Benutzerhandbuch XP-600 Series (HKLM-x32\...\XP-600 Series Useg) (Version:  - )
Epson Easy Photo Print 2 (HKLM-x32\...\{02A312B5-1542-47B6-BFE9-F51358C39E86}) (Version: 2.4.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Netzwerkhandbuch XP-600 Series (HKLM-x32\...\XP-600 Series Netg) (Version:  - )
Epson Print CD (HKLM-x32\...\{D16A31F9-276D-4968-A753-FFEAC56995D0}) (Version: 2.20.00 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON XP-600 Series Printer Uninstall (HKLM\...\EPSON XP-600 Series) (Version:  - SEIKO EPSON Corporation)
Evernote v. 5.6.4 (HKLM-x32\...\{DFDF0BE2-2D71-11E4-9454-00163E98E7D6}) (Version: 5.6.4.4632 - Evernote Corp.)
Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych (HKLM-x32\...\{B04A0E2F-1E4C-4E61-B18E-3B2BD6779CA7}) (Version: 15.4.5722.2 - Microsoft Corporation)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Gitarrero Leadstar 1.00 Demo (HKLM-x32\...\Gitarrero Leadstar Maxi Demo_is1) (Version: 1.00 - Baumgaertel/ Wetzel)
Gitarrero Notenmeister (HKLM-x32\...\Gitarrero Notenmeister) (Version:  - )
Guitar Explorer 1.0 (HKLM-x32\...\Guitar Explorer 1.0) (Version:  - )
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2669 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Java 7 Update 9 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417009FF}) (Version: 7.0.90 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
K-Lite Codec Pack 6.0.4 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 6.0.4 - )
LastPass (uninstall only) (HKLM-x32\...\LastPass) (Version:  - LastPass)
Lidl-Fotos (HKLM-x32\...\Lidl-Fotos_is1) (Version:  - )
Liederalbum Paulchen 1.0 (HKLM-x32\...\Liederalbum Paulchen_is1) (Version: 1.0 - Gitarrero Software GbR)
Line 6 Uninstaller (HKLM-x32\...\Line 6 Uninstaller) (Version:  - Line 6)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
M-DVD.Org V2 (HKLM-x32\...\{D831211C-EE0F-43E3-9F8C-E4832B34C18A}_is1) (Version: 2.0 - SynApp GmbH)
MediaMonkey 4.0 (HKLM-x32\...\MediaMonkey_is1) (Version: 4.0 - Ventis Media Inc.)
MediaShow 3.0 (HKLM-x32\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version:  - )
MEDION GoPal Assistant (HKLM-x32\...\{B9D45A76-61DF-4387-B0FE-CA165D582B57}) (Version: 6.3.6.13143 - MEDION)
MEDION NAS TOOL (HKLM-x32\...\MEDION NAS TOOL) (Version:  - MEDION)
Memeo Instant Backup (HKLM-x32\...\{8E666407-AC41-46a2-9692-6C7BFCBFDD37}) (Version: 4.60.0.7939 - Memeo Inc.)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{402ED4A1-8F5B-387A-8688-997ABF58B8F2}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC100_CRT_x86 (HKLM-x32\...\{6FDDB201-2CA0-42BD-973F-7B2C4A61EA3F}) (Version: 1.0.0 - Microsoft)
Mozilla Firefox 35.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 de)) (Version: 35.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-2389243879-3189858854-901359939-1000\...\MyFreeCodec) (Version:  - )
mySongBook Player (HKLM-x32\...\{42F6B687-F7B1-41A8-87CB-043FBBE4621D}_is1) (Version:  - Arobas Music)
Native Instruments DrumMicA (HKLM-x32\...\Native Instruments DrumMicA) (Version:  - Native Instruments)
Native Instruments Kontakt 5 (HKLM-x32\...\Native Instruments Kontakt 5) (Version: 5.4.2.245 - Native Instruments)
Native Instruments Service Center (HKLM-x32\...\Native Instruments Service Center) (Version: 2.4.1.1158 - Native Instruments)
Nero OEM (HKLM-x32\...\Nero - Burning Rom!UninstallKey) (Version:  - )
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
OpenOffice 4.1.0 Language Pack (German) (HKLM-x32\...\{ED7A9584-1F78-4CB0-B3E7-C30E6B7B02FE}) (Version: 4.10.9764 - Apache Software Foundation)
PhotoNow! 1.0 (HKLM-x32\...\{D36DD326-7280-11D8-97C8-000129760CBE}) (Version:  - )
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
PowerCinema 4.0 (HKLM-x32\...\{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version:  - )
PowerDirector (HKLM-x32\...\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version:  - )
PowerDVD (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version:  - )
PowerProducer (HKLM-x32\...\{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version:  - )
PSE11 STI Installer (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
RealSpeak Solo fur Deutsch - Steffi (HKLM-x32\...\{BFBB91DB-9F0F-4A9C-9669-A97DA3512CF2}) (Version: 4.00.0000 - ScanSoft)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6554 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.28.1 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.28.1 - Renesas Electronics Corporation) Hidden
RiffWorks T4 (HKLM-x32\...\RiffWorks T4) (Version: 2.6.7 - Sonoma Wire Works)
Samsung AllShare (HKLM-x32\...\InstallShield_{DF47ACA3-7C78-4C08-8007-AC682563C9F1}) (Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.)
Samsung AllShare (x32 Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.) Hidden
Samsung Link 2.0.0.1412161531 (HKLM\...\8474-7877-9059-0204) (Version: 2.0.0.1412161531 - Copyright 2013 SAMSUNG)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
SynthFont (HKLM-x32\...\SynthFont) (Version:  - )
TuneUp Utilities 2012 (HKLM-x32\...\TuneUp Utilities 2012) (Version: 12.0.3600.73 - TuneUp Software)
TuneUp Utilities 2012 (x32 Version: 12.0.3600.73 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.3600.73 - TuneUp Software) Hidden
Turbo Lister 2 (HKLM-x32\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.)
TuxGuitar 1.2 (HKLM-x32\...\TuxGuitar_0) (Version:  - )
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Mobile Device Center Driver Update (HKLM\...\{92DBCA36-9B41-4DD1-941A-AED149DD37F0}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
X10 Hardware(TM) (HKLM-x32\...\X10Hardware) (Version:  - )
Yamaha Steinberg USB Driver (HKLM-x32\...\InstallShield_{B590D7D4-CB5C-4919-971F-EC5EA982749D}) (Version: 1.8.4 - Yamaha Corporation)
Yamaha Steinberg USB Driver (Version: 1.8.4 - Yamaha Corporation) Hidden
YAMAHA THR Editor (HKLM-x32\...\{5115B75F-32BF-42CB-A8BC-2F0A71C4DF93}) (Version: 1.0.0 - Yamaha Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2389243879-3189858854-901359939-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\HARDY\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

13-01-2015 05:48:40 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
14-01-2015 09:09:56 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
14-01-2015 09:14:41 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
14-01-2015 13:31:22 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
14-01-2015 21:35:35 zoek.exe restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2012-06-22 08:23 - 00000895 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.google-analytics.com
127.0.0.1 google-analytics.com


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01CE3279-476C-4C5C-89E7-001A26E6B6E7} - System32\Tasks\{5BB6C394-6524-4F8B-A640-24C0C0EE135F} => pcalua.exe -a "C:\Program Files (x86)\MEDION GoPal Assistant\GoPal_Assistant.exe" -d "C:\Program Files (x86)\MEDION GoPal Assistant\"
Task: {06AABA14-7105-4EB2-BC8E-EE398ECAFB3A} - System32\Tasks\{88878B95-990B-4979-A309-6C22ADC9F564} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {07587E55-8173-4B0E-8466-B374FECC9A17} - System32\Tasks\Google Updater and Installer => C:\Users\HARDY\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {0E23132F-78C4-477F-BEC4-536D9230D3B8} - System32\Tasks\{FAAA3501-6F34-4738-B3EF-0463B08318A3} => pcalua.exe -a "C:\Program Files (x86)\UX Pack\uxuninst.exe"
Task: {1ED94247-E3C5-4CB4-A2C2-06D4E1FEA2EE} - System32\Tasks\{D9991832-5ADC-43C4-96E1-9A329B31AFC7} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {2176B983-DB3D-4B0D-ABFF-80C9E1818476} - System32\Tasks\{FE96BCB8-1055-4C80-A4B6-29977CEA30A8} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {271F7165-0A28-4336-A546-9BF1EDB7A573} - System32\Tasks\{2F04B778-7291-4D46-83C6-A0202F0774C8} => C:\Program Files (x86)\EvilLyrics\EvilLyrics.exe <==== ATTENTION
Task: {28A4A412-0271-4D91-803F-73536605C94F} - System32\Tasks\{9AE069F7-D45D-4AEB-AB11-8ADDF4741DC4} => pcalua.exe -a "C:\Program Files (x86)\watchmi\Tvd.Setup.HotfixCheck.exe" -d "C:\Program Files (x86)\watchmi"
Task: {2D58DAAB-3FC7-4E5E-8CBB-529B05FB0A2D} - System32\Tasks\{759734EE-496E-437D-8746-432732041486} => C:\Program Files (x86)\M-DVD.Org V2\M-DVD_Org.exe [2005-10-28] (SynApp GmbH)
Task: {36A849B5-E844-4A06-841B-002CC0D82026} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)
Task: {3DE9985D-06A9-47A9-BE05-600ED4218B83} - System32\Tasks\{E6EF038A-821D-4B61-9E42-5868F795AEB4} => pcalua.exe -a C:\Users\HARDY\Download\aolsync-outlook-plugin.exe -d C:\Users\HARDY\Download
Task: {3E7E3EED-5133-4F23-88DF-930349022346} - System32\Tasks\{FAA6E2C1-F82F-4731-9EE8-563DDCE51AAB} => pcalua.exe -a C:\Users\HARDY\Downloads\M2Tech_USB_Audio_Driver_r1.5.exe -d C:\Users\HARDY\Downloads
Task: {3FB73559-1448-45B9-90D1-CA0B79693468} - System32\Tasks\{F0151E50-0B1B-43C4-917C-AEDB54C2FEFE} => msiexec.exe /package "C:\Users\HARDY\Downloads\Adobe Photoshop Elements 10\PSE 10\Adobe Photoshop Elements 10.msi"
Task: {45E79AE0-A4D8-4CBF-9FDA-2389593A8B9B} - System32\Tasks\{B8FD48E8-898D-4018-A9AB-A7F0CD197129} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files (x86)\BlueStacks\HD-StartLauncher.exe"
Task: {4DEFCC07-ACB2-4B78-9C2D-5E017B27B6A9} - System32\Tasks\{3C9A141B-419D-4002-A2CA-2159148DB79E} => C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
Task: {5181B170-CAC3-467B-A4DB-FE54FEF884B7} - System32\Tasks\{B28959DD-C9C5-420E-8A9E-8D843DEDF87A} => pcalua.exe -a E:\FSetup.exe -d E:\
Task: {524BF74F-9B79-406C-876E-C7C1D616E3E8} - System32\Tasks\{8C5AB6D8-233E-4ED9-9E3B-3CD8723FD37F} => C:\Program Files (x86)\Line6\BackTrack Setup Utility\BackTrack Setup Utility.exe [2012-07-30] (Line 6, Inc.)
Task: {54F65104-84EB-47AA-AB1A-7035632FC313} - System32\Tasks\{CD3C0597-4080-4693-B3DD-2D241916A1E6} => pcalua.exe -a C:\Users\HARDY\Downloads\BlueStacks-ThinInstaller_0.7.0.725.exe -d C:\Users\HARDY\Downloads
Task: {5628FD7C-FDC2-4104-9109-63B6A3665961} - System32\Tasks\{6ED33290-8B02-400B-9B3E-C49B90DFBABE} => pcalua.exe -a "C:\Program Files (x86)\MEDION GoPal Assistant\Assistant_UninstallOldPerUser.exe" -d "C:\Program Files (x86)\MEDION GoPal Assistant"
Task: {575D1430-7D0C-42DA-95D8-BE243283A149} - System32\Tasks\{20982DC0-A7D6-4D10-B57C-E7F4DAD29F14} => C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
Task: {58445BE3-F7A9-4586-A461-D80CDB5E0359} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
Task: {5B3AF5D3-DB79-4EE3-849E-D9B760DD7E43} - System32\Tasks\AdobeAAMUpdater-1.0-HARDY-PC-Neu-HARDY => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)
Task: {5C3D9495-4A8A-40E6-909D-575C7DCF0096} - System32\Tasks\{314C74CA-5DC0-4402-8419-D5A08F874B87} => pcalua.exe -a C:\Users\HARDY\Desktop\Downloads\Silverlight_x64.exe -d C:\Users\HARDY\Desktop\Downloads
Task: {6E48003F-B06C-45A2-BB5E-115AF12F9901} - System32\Tasks\{802B389C-38BD-4B11-BCD6-21C39C2EC9C7} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {73B747D4-4652-4663-AFD3-F4476B42AB56} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {7CFAB931-83DD-4BCB-B6A5-12DA32CA5A81} - System32\Tasks\{D23C8B30-7D2B-4F6B-9CE5-7E4AEEACAEFA} => pcalua.exe -a "C:\Program Files (x86)\Line6\BackTrack Setup Utility\BackTrack Setup Utility.exe" -d "C:\Program Files (x86)\Line6\BackTrack Setup Utility"
Task: {7DB7619A-CC9B-4BB6-8F62-F574EDE06AC0} - System32\Tasks\{ED305C0B-E1FA-4171-8C8D-B8B5ACBBD759} => pcalua.exe -a "C:\Users\HARDY\Music\Ex.Fi.music\GuitarTricks.com Learn Guitar Tricks Video Lessons Tutorial\GuitarTricksVideoPlayer.exe" -d "C:\Users\HARDY\Music\Ex.Fi.music\GuitarTricks.com Learn Guitar Tricks Video Lessons Tutorial"
Task: {84ABDE2E-361E-4296-84F8-94FCC634DEB2} - System32\Tasks\Divx-Online-Aktualisierungsprogramm => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
Task: {84B91E6B-2D21-42DD-956C-F85F4FE126B2} - System32\Tasks\{BC4C6CFC-FCC3-43C1-80AC-5CE4D99AACE5} => C:\Program Files (x86)\Line6\BackTrack Setup Utility\BackTrack Setup Utility.exe [2012-07-30] (Line 6, Inc.)
Task: {8D1674D8-9973-4E0A-94A3-392960062A34} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {8EE5251C-F894-4179-9C22-2D20A54A32B6} - System32\Tasks\{01D13927-EBED-4E36-A400-5DECE39709A9} => C:\Program Files (x86)\Ahead\CoverDesigner\CoverDes.exe [2004-04-15] (Ahead Software AG)
Task: {901B4D67-8377-4153-BEAD-B1AA7A46AB1A} - System32\Tasks\{48EFBEA0-DA6C-401F-93BD-B0E04A62A8B5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
Task: {9322C93A-A674-4FD5-89DA-A19531B148EB} - System32\Tasks\{460EAC6F-0AFE-4AB5-8657-831693429A6E} => pcalua.exe -a C:\Users\HARDY\Desktop\BlueStacks-ThinInstaller_0.7.0.725.exe -d C:\Users\HARDY\Desktop
Task: {97FB23E3-6BA7-4D39-B8ED-1A9D76249CB4} - System32\Tasks\{30145EAF-8D60-42D4-863A-6C4141EA2CEE} => C:\Program Files (x86)\Samsung\AllShare\AllShare.exe [2012-03-01] (Samsung Electronics Co., Ltd.)
Task: {AA3CF6B7-F363-4E9F-9BA5-B23B845AEE5C} - System32\Tasks\{DE00E98D-63ED-4E35-8921-F23C8D409B38} => C:\Program Files (x86)\M-DVD.Org V2\M-DVD_Org.exe [2005-10-28] (SynApp GmbH)
Task: {AC09C7F6-EF6B-41C4-974D-23F6632561E9} - System32\Tasks\{FDA84CF0-A618-435B-A9E8-545843F2BDDA} => C:\Program Files (x86)\BlueStacks\HD-StartLauncher.exe
Task: {AD26D56E-D089-40AC-A3C7-B14BE6E66741} - System32\Tasks\{0CC5FEDB-992C-4E71-8859-F1BA3AAA8F18} => pcalua.exe -a C:\Users\HARDY\Downloads\Cinergy_HTC_Stick_Drv_Setup_5.09.1202.00_XP_Vista_7.exe -d C:\Users\HARDY\Downloads
Task: {ADC744E4-FC78-4793-B992-DE36840C9640} - System32\Tasks\{0E5C7BB1-C80B-4D91-AF1E-0332A31B448F} => C:\Program Files (x86)\Adobe Download Assistant\Adobe Download Assistant.exe
Task: {AE77B395-F8C1-4190-A852-EE83DC16E29A} - System32\Tasks\{CE222FC8-9669-483F-89F1-0486D79D29B4} => C:\Program Files (x86)\RssBandit\RSSBandit.exe
Task: {B3EFAB65-51E8-415D-A6AC-F11314027236} - System32\Tasks\{780B4A00-C1FC-400B-BEBA-13D528E78FFB} => C:\Program Files (x86)\BlueStacks\HD-StartLauncher.exe
Task: {BA45BD61-FDC3-4509-90A3-DA31C8D9FEAB} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {C2A00F78-2543-4964-B095-E83C9BE0202C} - System32\Tasks\{8719663D-A1F3-4EDE-8726-A0E44BEFF8F1} => pcalua.exe -a C:\Users\HARDY\Desktop\BlueStacks-ThinInstaller_0.7.0.722.exe -d C:\Users\HARDY\Desktop
Task: {C4EF3A20-157D-41BC-9832-FA80D8320326} - System32\Tasks\{1E730C56-CBFE-47A9-A175-2A6144A0A0B2} => C:\Program Files (x86)\Ahead\Nero\nero.exe [2004-05-06] (Ahead Software AG)
Task: {C81E95F1-6124-40D2-97D9-A83BD67BD421} - System32\Tasks\{E540C571-F025-406A-8C5A-F144F3FF899F} => pcalua.exe -a "C:\Program Files (x86)\MEDION GoPal Assistant\Assistant_Uninstaller.exe" -d "C:\Program Files (x86)\MEDION GoPal Assistant"
Task: {CF05FB4E-824A-404E-BE7F-6CE72D0E53F2} - System32\Tasks\{C41F6EF2-10D5-4426-9DCF-4A6EFECBCD69} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {CF9D471F-2AAA-4ED4-B5E0-9E2DA9735D25} - System32\Tasks\{86B33A8D-29F0-4297-ACA3-D1394DE020CA} => pcalua.exe -a E:\Home_Cinema\Setup.exe -d E:\Home_Cinema
Task: {D6C690BB-4EB5-4D06-AA56-9996A3F0E813} - System32\Tasks\{505E1B58-5E96-4D62-BF85-AA982B1E160F} => C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
Task: {D7C2F35D-C393-4A5D-AD63-C9E79494E65F} - System32\Tasks\{C2A63AA0-D21A-4AA0-B7C8-CC814CE913F3} => pcalua.exe -a "C:\Program Files (x86)\watchmi\Tvd.InstallHelper.exe" -d "C:\Program Files (x86)\watchmi"
Task: {E2D5B4A6-E936-4756-83D2-8B88D04F116B} - System32\Tasks\{4A8193B0-05BB-42F4-A752-A75DE28207D1} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {E520ADE3-7729-4FC3-9EDF-1B09A538FCE6} - System32\Tasks\{29443092-5F7D-4414-86A8-265824F62EB2} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {E94DD10D-FD72-48AB-9CBD-91007D990F99} - System32\Tasks\{F0775678-A8F8-446D-B2F7-3D956D048803} => C:\Program Files (x86)\EvilLyrics\EvilLyrics.exe <==== ATTENTION
Task: {EA6C3919-32EF-4153-8367-E7A035EE5F31} - System32\Tasks\{ED2DC00A-6486-4DCE-B8BA-E0D9A7089A4D} => C:\Program Files (x86)\MEDION GoPal Assistant\GoPal_Assistant.exe [2013-11-20] (MEDION)
Task: {ECB8AF17-E5A6-4977-8C17-C795D546D4D9} - System32\Tasks\{6AC9A34D-B86D-45D2-A7B7-F7D87546F115} => C:\Program Files (x86)\Adobe Download Assistant\Adobe Download Assistant.exe
Task: {EF8F9F25-B3CD-45FC-9647-B6D28DFC5156} - System32\Tasks\{C447C259-0B28-4827-9929-E3EB6BDD4D08} => C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe
Task: {F6F0702F-2479-449F-9FA9-81774499CA59} - System32\Tasks\{61F45520-D525-4268-82D0-FE6FFB16268B} => C:\Program Files (x86)\Samsung\AllShare\AllShare.exe [2012-03-01] (Samsung Electronics Co., Ltd.)
Task: {FFB5A3D0-32D3-40F5-89FD-7BFA071CCB3A} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe [2012-05-29] (TuneUp Software)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-06-21 08:39 - 2012-06-05 18:55 - 00091648 _____ () C:\Program Files (x86)\MediaMonkey\DeskPlayer.dll
2014-03-06 14:00 - 2014-03-06 14:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2014-08-07 10:39 - 2014-08-07 10:39 - 00014336 _____ () C:\Program Files (x86)\COMPUTER BILD Account-Alarm\BCrypt.Net.dll
2014-10-26 09:24 - 2014-10-26 09:24 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\1eeea3ab8d69ec722bdcb28b8eb8dd75\IsdiInterop.ni.dll
2012-03-13 00:11 - 2012-02-02 00:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-01-13 19:11 - 2015-01-13 19:11 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-03-21 13:37 - 2014-03-21 13:37 - 01020928 _____ () C:\Users\HARDY\AppData\Roaming\Mozilla\Firefox\Profiles\3ns3nsl5.default-1349855230406\extensions\support@lastpass.com\platform\WINNT_x86-msvc\components\lpxpcom.dll
2014-04-20 00:42 - 2014-04-20 00:42 - 00468672 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-04-20 00:42 - 2014-10-08 09:10 - 00642344 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2014-04-20 00:42 - 2014-04-20 00:42 - 00347328 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com\nponlinebanking.dll
2015-01-14 14:48 - 2015-01-14 14:48 - 16844464 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00113171 _____ () C:\Program Files (x86)\VideoLAN\VLC\libvlc.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 02396691 _____ () C:\Program Files (x86)\VideoLAN\VLC\libvlccore.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00268307 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdshow_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00027667 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00031251 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 11148307 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 01248787 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libxml_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00066579 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 02043411 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00100371 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_bd_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00244243 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00076307 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_vdr_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00045587 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00060947 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libsmooth_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00531475 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libhttplive_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00708627 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libdash_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00114195 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libzip_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00040467 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libstream_filter_rar_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00014867 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00133139 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 01512467 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00296979 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\lua\liblua_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00189971 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00054291 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00038419 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\control\libglobalhotkeys_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00292371 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libpng_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00017939 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 01280019 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00018451 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libdts_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00336403 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00344595 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00013843 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00018963 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 01496083 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\HARDY\Documents\2013-09-08 09.43.35.jpg:com.dropbox.attributes

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeActiveFileMonitor11.0 => 2
MSCONFIG\Services: AdobeActiveFileMonitor8.0 => 2
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: DevoloNetworkService => 2
MSCONFIG\Services: FontCache => 2
MSCONFIG\Services: Samsung Link Service => 2
MSCONFIG\Services: SimpleSlideShowServer => 3
MSCONFIG\Services: WMPNetworkSvc => 2

========================= Accounts: ==========================

Administrator (S-1-5-21-2389243879-3189858854-901359939-500 - Administrator - Disabled)
Gast (S-1-5-21-2389243879-3189858854-901359939-501 - Limited - Enabled) => C:\Users\Gast
HARDY (S-1-5-21-2389243879-3189858854-901359939-1000 - Administrator - Enabled) => C:\Users\HARDY
HomeGroupUser$ (S-1-5-21-2389243879-3189858854-901359939-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/15/2015 00:51:12 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (01/14/2015 08:52:18 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (01/14/2015 07:46:32 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm MEDIAM~2.EXE, Version 4.0.5.1496 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 3cb50

Startzeit: 01d03024da8ae955

Endzeit: 14

Anwendungspfad: C:\PROGRA~2\MEDIAM~1\MEDIAM~2.EXE

Berichts-ID:

Error: (01/14/2015 07:13:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.1.711, Zeitstempel: 0x542b53ec
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e3be
ID des fehlerhaften Prozesses: 0x3bcc0
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3

Error: (01/13/2015 00:22:14 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (01/13/2015 06:46:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x59f4
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (01/13/2015 06:46:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x5628
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (01/13/2015 06:46:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x6004
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (01/13/2015 05:47:39 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: NT-AUTORITÄT)
Description: Die Anwendung oder der Dienst "Compatibility Verify" konnte nicht heruntergefahren werden.

Error: (01/12/2015 07:58:16 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.


System errors:
=============
Error: (01/15/2015 06:06:29 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Samsung Link Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/14/2015 10:05:09 PM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: 192.168.178.22192.168.137.0255.255.255.0

Error: (01/14/2015 10:05:09 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:

Error: (01/14/2015 10:04:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ZoneAlarm Privacy Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (01/14/2015 09:50:12 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (01/14/2015 09:50:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (01/14/2015 09:50:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (01/14/2015 09:50:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (01/14/2015 09:50:10 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (01/14/2015 09:19:23 PM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: 192.168.178.22192.168.137.0255.255.255.0


Microsoft Office Sessions:
=========================
Error: (01/15/2015 00:51:12 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\Epson Software\Download Navigator\EPSDNAVI.EXE

Error: (01/14/2015 08:52:18 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\Epson Software\Download Navigator\EPSDNAVI.EXE

Error: (01/14/2015 07:46:32 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: MEDIAM~2.EXE4.0.5.14963cb5001d03024da8ae95514C:\PROGRA~2\MEDIAM~1\MEDIAM~2.EXE

Error: (01/14/2015 07:13:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.1.711542b53ecntdll.dll6.1.7601.18247521ea8e7c00000050002e3be3bcc001d0302597827d56C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exeC:\Windows\SysWOW64\ntdll.dll070bf3f8-9c19-11e4-bbf3-8c89a5cac3ba

Error: (01/13/2015 00:22:14 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\Epson Software\Download Navigator\EPSDNAVI.EXE

Error: (01/13/2015 06:46:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe34.0.5.54435475dd5dmozalloc.dll34.0.5.54435475d664800000030000142559f401d02eefaefd0230C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll7feec848-9ae7-11e4-a7d5-8c89a5cac3ba

Error: (01/13/2015 06:46:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe34.0.5.54435475dd5dmozalloc.dll34.0.5.54435475d6648000000300001425562801d02eefad2925b6C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll7fe419c0-9ae7-11e4-a7d5-8c89a5cac3ba

Error: (01/13/2015 06:46:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe34.0.5.54435475dd5dmozalloc.dll34.0.5.54435475d6648000000300001425600401d02eefae3a2486C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll7b3aa476-9ae7-11e4-a7d5-8c89a5cac3ba

Error: (01/13/2015 05:47:39 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: NT-AUTORITÄT)
Description: 1C:\Users\HARDY\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exeCompatibility Verify0302621612280143003A005C00550073006500720073005C00480041005200440059005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C0043006F006D007000610074006900620069006C006900740079002000560065007200690066006900650072005C0063006F006D007000610074006900620069006C0069007400790063006800650063006B007300760063002E006500780065000000

Error: (01/12/2015 07:58:16 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\Epson Software\Download Navigator\EPSDNAVI.EXE


CodeIntegrity Errors:
===================================
  Date: 2014-12-16 07:31:44.272
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-16 07:31:44.212
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-12 20:15:06.889
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-12 20:15:06.887
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-12 20:15:06.872
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-12 20:15:06.870
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-12 20:13:57.338
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-12 20:13:57.309
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-26 08:08:01.158
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-26 08:08:00.922
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) CPU G630 @ 2.70GHz
Percentage of memory in use: 62%
Total physical RAM: 3975.64 MB
Available physical RAM: 1478.28 MB
Total Pagefile: 7949.46 MB
Available Pagefile: 4797.26 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:414.66 GB) (Free:15.12 GB) NTFS
Drive d: (Recover) (Fixed) (Total:50 GB) (Free:16.84 GB) NTFS
Drive f: () (Removable) (Total:0.48 GB) (Free:0.37 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: DD3B8AC5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=414.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

========================================================
Disk: 4 (Size: 495.5 MB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

deeprybka 15.01.2015 22:27
Ok, paar Sachen müssen wir noch fixen, schauen wir mal was ESET noch so findet.

Schritt 1

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


HartmutA 16.01.2015 10:21
Ich konnte leider keine log.txt Datei finden 1.Anwendung wurde gefunden und gelöscht.
Ich habe ein Bildschirm-Foto vom Explorer aber bekomme es nicht in die Nachricht kopiert. Gruß Hartmut


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:23 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131