Trojaner-Board - JS/Agent.NKW Trojaner auf unserer Homepage

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - JS/Agent.NKW Trojaner auf unserer Homepage (https://www.trojaner-board.de/156914-js-agent-nkw-trojaner-unserer-homepage.html)

JS/Agent.NKW Trojaner auf unserer Homepage

Hallo liebes Forum,

wir haben seit einiger Zeit das Problem, dass sich wahrscheinlich ein Trojaner bei uns auf der Homepage eingeschlichen hat.
Mir sind nun von einigen Quellen zu Ohren gekommen, dass Leute nicht mehr unsere Homepage ansteuern können bzw. Das Virenprogramm Alarm schlägt.
Hier eine Meldung die vom Antivirensystem eines Kollegen mir zugemailt wurde:

https://dl.dropboxusercontent.com/u/36424005/image001.png

Ich selbst habe wenig Ahnung, was ich hier machen bzw. Wie ich den Trojaner aufspühren kann und bin um jeden Rat froh!
Die Seite selbst habe ich für unseren Sportverein in Joomla erstellt.

Ich denke den ersten Schritt was ich machen sollte ist die Seite auf die aktuelle Joomlaversion upzudaten? Zwar sagt mir das Backend, dass Joomla aktuell sei - haben die Version 2.5.3 - aber ich weiß seit vorhin, dass die aktuelle Version 2.5.23 ist. Alternativ vielleicht sogar auf 3.3.3 updaten?
EDIT: Ich habe nun auf die aktuelle Joomlaversion 2.5.24 geupdated!

Vielleicht kann mir jemand bei meinem Problem helfen?!

Danke im Voraus....

Viele Grüße
Mariano

hi,

hast du ein sauberes Backup der Seite? Mit dem Seitencode kann ich nicht helfen, aber vielleicht ist der Rechner, mit dem FTP gemacht wird, verseucht.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hi und Danke dir für deine erste Antwort!

Die Sache mit dem Backup habe ich wohl zu oft vernachlässigt und deshalb nur ein sehr altes parat. Ist über ein Jahr alt!
FTP Files hochgeladen meist bzw. ausschließlich mit diesem Laptop!
Scan vom Farbar's Recovery Scan Tool unten angehängt.

Habe auf meinem Laptop DeepFreeze installiert. Eine Software, die quasi einen eingefrorenen Zustand des Systems definiert (betroffen hiervon die Systempartition C), der nach jedem Neustart wieder hergestellt wird und gehofft, deshalb keine Chance einem Trojaner oder anderem Virus zu geben.

FRST.txt:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014

Ran by Mariano (administrator) on MARIANO-LAPTOP on 27-07-2014 13:59:58

Running from D:\Benutzer\Mariano\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe

(COMODO) C:\Program Files\Internettools\COMODO\COMODO Internet Security\cfp.exe

(DT Soft Ltd) C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTShellHlp.exe

(Faronics Corporation) C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(DT Soft Ltd) C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTAgent.exe

(Steganos Software GmbH) C:\Program Files (x86)\Steganos Online Shield\OnlineShieldClient.exe

(Dell) D:\Benutzer\Mariano\AppData\Local\Apps\2.0\TLWZ2CG6.15O\62DQ7C9Q.K6T\dell..tion_0f612f649c4a10af_0005.0006_f9e15713f5aac8ac\DellSystemDetect.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(SoftBureau.com) C:\Program Files (x86)\CD Locker\CDLocker.exe

() D:\Benutzer\Mariano\Portable Anwendungen\CLCL\CLCL.exe

(Dropbox, Inc.) D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\Dropbox.exe

() D:\Benutzer\Mariano\Downloads\Easytoolz\EasyToolz.exe

(Bartels Media GmbH) D:\Benutzer\Mariano\Portable Anwendungen\PhraseExpress 10.1.57 Portable\phraseexpress.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Apple Inc.) C:\Program Files (x86)\Playertools\iTunes\iTunesHelper.exe

(Visagesoft) C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfprsrv.exe

(Microsoft Corporation) C:\Windows\splwow64.exe

(VMware, Inc.) C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-tray.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Mozilla Corporation) D:\Benutzer\Mariano\Portable Anwendungen\ThunderbirdPortable\App\Thunderbird\thunderbird.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

(Mozilla Corporation) D:\Benutzer\Mariano\Portable Anwendungen\FirefoxPortable\App\Firefox\firefox.exe

(Mozilla Corporation) D:\Benutzer\Mariano\Portable Anwendungen\FirefoxPortable\App\Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe

(PortableApps.com) D:\Benutzer\Mariano\Portable Anwendungen\FileZillaPortable\FileZillaPortable.exe

() D:\Benutzer\Mariano\Portable Anwendungen\Scribble Papers\ScPapers.exe

(FileZilla Project) D:\Benutzer\Mariano\Portable Anwendungen\FileZillaPortable\App\filezilla\filezilla.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6561384 2010-12-14] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2010-12-10] (Realtek Semiconductor)

HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [4479648 2011-01-25] (Dell Inc.)

HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\Internettools\COMODO\COMODO Internet Security\cfp.exe [9577680 2012-11-08] (COMODO)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2531624 2010-12-17] (Synaptics Incorporated)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" 

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart 

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\Playertools\iTunes\iTunesHelper.exe [421776 2012-09-10] (Apple Inc.)

HKLM-x32\...\Run: [vspdfprsrv.exe] => C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfprsrv.exe [6082560 2012-04-23] (Visagesoft)

HKLM-x32\...\Run: [vmware-tray] => C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-tray.exe [96816 2008-10-29] (VMware, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

Winlogon\Notify\DfLogon: LogonDll.dll [X]

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTAgent.exe [4527424 2011-08-17] (DT Soft Ltd)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [CCWinTray] => C:\Windows\tray\wintmr.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [SOS_Agent] => C:\Program Files (x86)\Steganos Online Shield\OnlineShieldClient.exe [4493536 2013-05-16] (Steganos Software GmbH)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [Free CD/DVD Guard] => C:\Program Files (x86)\Free CD-DVD Guard\cddg.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [DellSystemDetect] => D:\Benutzer\Mariano\AppData\Local\Apps\2.0\TLWZ2CG6.15O\62DQ7C9Q.K6T\dell..tion_0f612f649c4a10af_000 (the data entry has 45 more characters).

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {6c175d68-4d4a-11e3-a6e9-005056c00008} - G:\.\Setup.exe AUTORUN=1

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {6c175d88-4d4a-11e3-a6e9-005056c00008} - G:\.\Setup.exe AUTORUN=1

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {b1b7974c-11d9-11e1-b387-806e6f6e6963} - F:\autoRcd.exe

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {ffe51fc2-b8a5-11e2-bba9-005056c00008} - G:\AutoRun.exe

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {ffe51fdf-b8a5-11e2-bba9-005056c00008} - G:\AutoRun.exe

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-05-20] (NVIDIA Corporation)

AppInit_DLLs:  C:\Windows\system32\guard64.dll => C:\Windows\system32\guard64.dll [390392 2012-11-08] (COMODO)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-05-20] (NVIDIA Corporation)

AppInit_DLLs-x32:  C:\Windows\SysWOW64\guard32.dll => C:\Windows\SysWOW64\guard32.dll [301264 2012-11-08] (COMODO)

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EasyToolz.lnk

ShortcutTarget: EasyToolz.lnk -> D:\Benutzer\Mariano\Downloads\Easytoolz\EasyToolz.exe ()

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk

ShortcutTarget: PhraseExpress.lnk -> D:\Benutzer\Mariano\Portable Anwendungen\PhraseExpress 10.1.57 Portable\phraseexpress.exe (Bartels Media GmbH)

ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

BootExecute: autocheck autochk /k:C /k:D * 
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&CUI=UN13394157651797316&UM=2&ctid=CT3317892

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com

URLSearchHook: HKCU - (No Name) - {422f7661-9403-4da4-b4ef-cc3e268817b5} - No File

SearchScopes: HKCU - DefaultScope {BDA29CAD-38C8-4BFC-85E9-D14EC4AC83C8} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3317892&CUI=UN13394157651797316&UM=2

SearchScopes: HKCU - {0C0959A2-B193-4209-8431-E81BE6AE5205} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {6E7B2DC4-58AD-48AB-9351-176746EFEA87} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {86D6A1A3-AF61-4326-B4A4-085589A36AFD} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {A15D9866-E120-4E4D-A7AA-4E24ED726EFB} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {BDA29CAD-38C8-4BFC-85E9-D14EC4AC83C8} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3317892&CUI=UN13394157651797316&UM=2

SearchScopes: HKCU - {C7764045-5997-4A9C-A30C-866C6AF7A45F} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {E1EE7EFD-6157-4437-A45B-70D1F3E75749} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->  No File

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Perfect PDF 7 - {277BA090-1A90-4EDD-8F61-6574E274F50A} - C:\Program Files (x86)\Bearbeitungstools\Perfect PDF 7\ieagent64.dll (soft Xpansion)

Toolbar: HKLM-x32 - Perfect PDF 7 - {277BA090-1A90-4EDD-8F61-6574E274F50A} - C:\Program Files (x86)\Bearbeitungstools\Perfect PDF 7\ieagent32.dll (soft Xpansion)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Winsock: Catalog9 11 C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vsocklib.dll [330288] (VMware, Inc.)

Winsock: Catalog9 12 C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vsocklib.dll [330288] (VMware, Inc.)

Winsock: Catalog9-x64 11 C:\Program Files (x86)\Playertools\VMware\VMware Workstation\x64\vsocklib.dll [438320] (VMware, Inc.)

Winsock: Catalog9-x64 12 C:\Program Files (x86)\Playertools\VMware\VMware Workstation\x64\vsocklib.dll [438320] (VMware, Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default

FF Homepage: www.google.de

FF NetworkProxy: "backup.ftp", ""

FF NetworkProxy: "backup.ftp_port", 0

FF NetworkProxy: "backup.socks", ""

FF NetworkProxy: "backup.socks_port", 0

FF NetworkProxy: "backup.ssl", ""

FF NetworkProxy: "backup.ssl_port", 0

FF NetworkProxy: "ftp", "200.130.146.35"

FF NetworkProxy: "ftp_port", 80

FF NetworkProxy: "http", "200.130.146.35"

FF NetworkProxy: "http_port", 80

FF NetworkProxy: "share_proxy_settings", true

FF NetworkProxy: "socks", "200.130.146.35"

FF NetworkProxy: "socks_port", 80

FF NetworkProxy: "ssl", "200.130.146.35"

FF NetworkProxy: "ssl_port", 80

FF NetworkProxy: "type", 4

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\Playertools\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\BEARBE~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @soft-xpansion/npsxpdf - C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll (soft-Xpansion)

FF user.js: detected! => D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\user.js

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{0911546D-894C-4426-8EA0-1F403CA32652}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{7F915D2E-7D07-4CF2-9B7E-B3E7D61CB861}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{81D5A205-FC3F-424B-9B01-509CD9A18B37}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{87245C8D-940D-4713-8A08-0E6E8B9E78E4}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{D4856139-5791-401C-AC00-CAF7B8984560}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{EEED5176-DC4F-4474-9F79-2C171AC02607}.xml

FF Extension: ProxTube - Unblock YouTube - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\ich@maltegoetz.de [2013-12-13]

FF Extension: Adblock Plus Pop-up Addon - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\adblockpopups@jessehakanen.net.xpi [2013-02-24]

FF Extension: Firebug - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\firebug@software.joehewitt.com.xpi [2012-04-23]

FF Extension: FlashGot - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2014-02-07]

FF Extension: CoolPreviews - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}.xpi [2013-02-24]

FF Extension: Adblock Plus - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-24]

FF Extension: Download Statusbar - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2012-01-19]

FF HKLM-x32\...\Firefox\Extensions: [{9C163D15-E392-44d7-BAF5-B8278E005611}] - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb

FF Extension: soft Xpansion Perfect PDF 7 - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb [2013-08-19]

FF HKLM-x32\...\Thunderbird\Extensions: [{9C163D15-E392-44d7-BAF5-B8278E005611}] - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb

FF HKCU\...\Firefox\Extensions: [{cc5a9034-5e34-43a4-ab29-98b939fa1a74}] - C:\Program Files (x86)\Show-Password\136.xpi

FF StartMenuInternet: FIREFOX.EXE - D:\Benutzer\Mariano\Portable Anwendungen\FirefoxPortable\App\Firefox\firefox.exe
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2356408 2014-06-19] (Microsoft Corporation)

R2 cmdAgent; C:\Program Files\Internettools\COMODO\COMODO Internet Security\cmdagent.exe [2828408 2012-11-08] (COMODO)

S3 DataIglooService; C:\Program Files (x86)\Bearbeitungstools\Faronics\Data Igloo Standard\DIService.exe [154384 2010-12-08] (Faronics Corporation)

R2 DFServ; C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DFServ.exe [1075200 2011-09-01] (Faronics Corporation) [File not signed]

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)

R2 MSSQLSERVER; d:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe [62218696 2012-06-29] (Microsoft Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] ()

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1618888 2014-04-30] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21009352 2014-04-30] (NVIDIA Corporation)

R2 Online Shield Starter Service; C:\Program Files (x86)\Steganos Online Shield\OnlineShieldService.exe [303368 2013-05-16] (Steganos Software GmbH)

R2 PaloServerService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo\palo.exe [11776 2011-08-04] (Jedox AG) [File not signed]

R2 PaloSuiteHttpdService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\httpd.exe [20549 2010-10-18] (Apache Software Foundation) [File not signed]

R2 PaloSuiteMolapService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\palo\palo.exe [11776 2011-08-04] (Jedox AG) [File not signed]

R2 PaloSuiteTomcatService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\tomcat\bin\paloTomcat6.exe [57344 2011-06-30] (Apache Software Foundation) [File not signed]

R2 PaloWebCoreService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\core3\core.exe [1944576 2011-07-25] (Jedox AG) [File not signed]

R2 QDLService2kDell; C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kDell.exe [331512 2010-06-25] (QUALCOMM, Inc.)

S4 SQLSERVERAGENT; d:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE [441288 2012-06-29] (Microsoft Corporation)

S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-08-19] (soft Xpansion)

S3 ufad-ws60; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-ufad.exe [191024 2008-10-02] (VMware, Inc.)

R2 VMAuthdService; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-authd.exe [113200 2008-10-29] (VMware, Inc.)

R2 WMCoreService; C:\Program Files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe [463912 2010-08-18] (Ericsson AB)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [584056 2012-11-08] (COMODO)

R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [38144 2012-11-08] (COMODO)

R0 DeepFrz; C:\Windows\System32\Drivers\DeepFrz.sys [234520 2011-09-01] (Faronics Corporation)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [271424 2011-11-19] (DT Soft Ltd)

R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37392 2010-05-20] (Paragon Software Group)

R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [94288 2012-11-08] (COMODO)

R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [301512 2014-05-20] (NVIDIA Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19744 2014-04-30] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

S4 RsFx0153; C:\Windows\System32\DRIVERS\RsFx0153.sys [321992 2012-06-29] (Microsoft Corporation)

R2 vstor2-ws60; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vstor2-ws60.sys [32816 2008-10-02] (VMware, Inc.)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-07-27 13:59 - 2014-07-27 14:00 - 00027566 _____ () D:\Benutzer\Mariano\Desktop\FRST.txt

2014-07-27 13:58 - 2014-07-27 14:00 - 00000000 ____D () C:\FRST

2014-07-27 13:58 - 2014-07-27 13:58 - 02093568 _____ (Farbar) D:\Benutzer\Mariano\Desktop\FRST64.exe

2014-07-27 13:11 - 2014-07-27 13:11 - 05981830 _____ (Tim Kosse) D:\Benutzer\Mariano\Downloads\FileZilla_3.9.0.1_win32-setup.exe

2014-07-27 11:30 - 2014-07-27 11:30 - 01029760 _____ () C:\Windows\Minidump\072714-17986-01.dmp
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-07-27 14:00 - 2014-07-27 13:59 - 00027566 _____ () D:\Benutzer\Mariano\Desktop\FRST.txt

2014-07-27 14:00 - 2014-07-27 13:58 - 00000000 ____D () C:\FRST

2014-07-27 13:58 - 2014-07-27 13:58 - 02093568 _____ (Farbar) D:\Benutzer\Mariano\Desktop\FRST64.exe

2014-07-27 13:11 - 2014-07-27 13:11 - 05981830 _____ (Tim Kosse) D:\Benutzer\Mariano\Downloads\FileZilla_3.9.0.1_win32-setup.exe

2014-07-27 13:10 - 2011-11-18 13:40 - 01386818 _____ () C:\Windows\WindowsUpdate.log

2014-07-27 12:11 - 2013-06-19 17:30 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-07-27 11:39 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-27 11:39 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-27 11:34 - 2011-11-21 21:19 - 00000000 ___RD () D:\Benutzer\Mariano\Dropbox

2014-07-27 11:34 - 2011-11-19 14:11 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Roaming\Dropbox

2014-07-27 11:30 - 2014-07-27 11:30 - 01029760 _____ () C:\Windows\Minidump\072714-17986-01.dmp

2014-07-27 11:30 - 2013-12-31 01:26 - 00001576 _____ () D:\Benutzer\Mariano\AppData\Roaming\EasyToolz.ini

2014-07-27 11:30 - 2013-02-17 18:27 - 00000000 ____D () C:\Windows\Minidump

2014-07-27 11:30 - 2011-11-18 20:23 - 00212077 _____ () C:\Windows\DFError.log

2014-07-27 11:30 - 2011-11-18 20:19 - 16336624 _____ () C:\Persi0.sys

2014-07-27 11:30 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-27 11:30 - 2009-07-14 06:51 - 00039971 _____ () C:\Windows\setupact.log

2014-07-27 11:29 - 2010-11-21 05:47 - 00162580 _____ () C:\Windows\PFRO.log

2014-07-26 12:12 - 2014-06-19 12:39 - 00000000 ____D () D:\Benutzer\Mariano\Documents\PhraseExpress

2014-07-26 10:05 - 2011-11-19 14:11 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-07-20 22:34 - 2011-10-19 19:26 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\1-Click-Hoster

2014-07-05 11:57 - 2012-03-02 19:31 - 00002004 ____H () D:\Benutzer\Mariano\Documents\Default.rdp
 

Some content of TEMP:

====================

D:\Benutzer\Mariano\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp8la7po.dll

D:\Benutzer\Mariano\AppData\Local\Temp\nvSCPAPI.dll

D:\Benutzer\Mariano\AppData\Local\Temp\nvStInst.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-04-04 02:16
 

==================== End Of Log ============================

--- --- ---

Addition.txt:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-07-2014

Ran by Mariano at 2014-07-27 14:00:46

Running from D:\Benutzer\Mariano\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: COMODO Defense+ (Enabled - Up to date) {FEEA52D5-051E-08DD-07EF-2F009097607D}

FW: COMODO Firewall (Enabled) {7DB03214-694B-060B-1600-BD4715C36DBB}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Adobe Flash Player 11 ActiveX 64-bit (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.1.102.55 - Adobe Systems Incorporated)

Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.7.700.202 - Adobe Systems Incorporated)

Age of Wonders III (HKLM-x32\...\GOGPACKAGEOFWONDERS3_is1) (Version: 2.0.0.4 - GOG.com)

Apple Application Support (HKLM-x32\...\{63EC2120-1742-4625-AA47-C6A8AEC9C64C}) (Version: 2.2.2 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}) (Version: 6.0.0.59 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Artisteer 3 (HKLM-x32\...\Artisteer 3) (Version: 3.0 - Extensoft)

Assassins Creed IV Black Flag Freedom Cry (HKLM-x32\...\QXNzYXNzaW5zQ3JlZWRJVkJsYWNrRmxhZw==_is1) (Version: 1 - )

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

CD Locker 1.0 (HKLM-x32\...\CD Locker) (Version: 1.0 - SoftBureau.com)

COMODO Internet Security (HKLM\...\{4EAB2511-0135-48CA-A47B-CE1E6836793A}) (Version: 5.8.15089.2124 - COMODO Security Solutions Inc.)

DAEMON Tools Pro (HKLM-x32\...\DAEMON Tools Pro) (Version: 4.41.0315.0262 - DT Soft Ltd)

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{92C42EDD-6524-4577-B2EB-6C68C63B6D4A}) (Version:  - Microsoft)

Dell System Detect (HKCU\...\9204f5692a8faf3b) (Version: 5.6.0.4 - Dell)

Dell Wireless HSPA Mini-Card Drivers (HKLM-x32\...\{9D583F01-A973-4B04-90BD-FB7886779090}) (Version: 6.1.26.6 - Dell)

Dropbox (HKCU\...\Dropbox) (Version: 2.10.3 - Dropbox, Inc.)

EASEUS Data Recovery Wizard Professional 5.0.1 (HKLM-x32\...\EASEUS Data Recovery Wizard Professional 5.0.1_is1) (Version:  - EASEUS)

Faronics Data Igloo Standard (HKLM-x32\...\{026A71FA-4117-45CF-BA98-8751E103CD22}) (Version: 1.31.1110.315 - Ihr Firmenname)

Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (HKLM-x32\...\{8343C2D8-09DF-38B3-9D1A-A26148918E45}.KB947789) (Version: 1 - Microsoft Corporation)

Intel PROSet Wireless (Version:  - ) Hidden

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2342 - Intel Corporation)

Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{BEE86606-EFB5-4353-9F34-29E0C59CDCFA}) (Version: 15.2.0.0284 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)

Intel® PROSet/Wireless WiFi-Software (HKLM\...\{181BBF43-CA17-4E1A-A78D-81E67A57B8A4}) (Version: 15.02.0000.1258 - Intel Corporation)

iTunes (HKLM\...\{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}) (Version: 10.7.0.21 - Apple Inc.)

Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

Java(TM) 6 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle)

Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)

Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2013 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 15.0.4631.1002 - Microsoft Corporation)

Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Report Viewer Redistributable 2008 (KB971119) (x32 Version: 9.0.30731 - Microsoft Corporation) Hidden

Microsoft Report Viewer Redistributable 2008 SP1 (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 (KB971119)) (Version:  - Microsoft Corporation)

Microsoft Report Viewer Redistributable 2008 SP1 Language Pack - DEU (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 SP1 Language Pack - DEU) (Version:  - Microsoft Corporation)

Microsoft Report Viewer Redistributable 2008 SP1 Language Pack - DEU (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden

Microsoft SQL Server 2008 R2 (64 Bit) (HKLM\...\Microsoft SQL Server 2008 R2) (Version:  - Microsoft Corporation)

Microsoft SQL Server 2008 R2 (64 Bit) (Version:  - Microsoft Corporation) Hidden

Microsoft SQL Server 2008 R2 Native Client (HKLM\...\{992B55F9-FD13-42C5-8B3C-B7E9F998A969}) (Version: 10.52.4000.0 - Microsoft Corporation)

Microsoft SQL Server 2008 R2 RsFx Driver (Version: 10.52.4000.0 - Microsoft Corporation) Hidden

Microsoft SQL Server 2008 R2-Richtlinien (HKLM-x32\...\{78033A38-50E2-4A65-823F-C1B34DF9FE41}) (Version: 10.50.1600.1 - Microsoft Corporation)

Microsoft SQL Server 2008 R2-Setup (Deutsch) (HKLM\...\{8E7A48F0-44F6-4ECD-86E1-C345CDD35791}) (Version: 10.52.4000.0 - Microsoft Corporation)

Microsoft SQL Server Browser (HKLM-x32\...\{8DD113A8-811A-404E-A4D7-443D014946AC}) (Version: 10.52.4000.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 Query Tools DEU (HKLM-x32\...\{3888A22E-1A9E-4DBE-A93B-42385141F37D}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft SQL Server VSS Writer (HKLM\...\{FBBA9369-3A6B-4EE3-9C53-DA0D29C2FC95}) (Version: 10.52.4000.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM-x32\...\{4ECF4BDC-8387-329A-ABE9-CF5798F84BB2}) (Version: 9.0.35191 - Microsoft Corporation)

Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (HKLM-x32\...\{8343C2D8-09DF-38B3-9D1A-A26148918E45}) (Version: 9.0.35191 - Microsoft Corporation)

NVIDIA 3D Vision Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)

NVIDIA GeForce Experience 2.0.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0.1 - NVIDIA Corporation)

NVIDIA Grafiktreiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.154.1168 - NVIDIA Corporation) Hidden

NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Optimus Update 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden

NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden

NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)

NVIDIA ShadowPlay 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden

NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden

NVIDIA Systemsteuerung 337.88 (Version: 337.88 - NVIDIA Corporation) Hidden

NVIDIA Update 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden

NVIDIA Update Core (Version: 12.4.67 - NVIDIA Corporation) Hidden

NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4631.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4631.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4631.1002 - Microsoft Corporation) Hidden

Palo for Excel 3.2 - Community Edition (HKLM-x32\...\{6B764F17-E232-4494-92DE-3ABC3FDE0C0E}_is1) (Version: 3.2.2.5096 - Jedox AG)

Palo Suite 3.2 - Community Edition (HKLM-x32\...\{125E8B3D-F78A-4525-80C2-E0E3ADCE12D9}_is1) (Version: 3.2.4166.5160 - Jedox AG)

Paragon Partition Manager™ 11 Professional (HKLM-x32\...\{A35001F0-F1E4-11DD-A38B-005056C00008}) (Version: 90.00.0003 - Paragon Software)

PDF Experte 8 Ultimate (HKLM-x32\...\{FC279721-37A6-4777-AFD8-7A56681EBA14}) (Version: 8.0.0140.0 - Avanquest software)

Qualcomm Gobi 2000 Package for Dell (HKLM-x32\...\{55958FAE-1862-4EE5-96BB-B9309CACE1C0}) (Version: 1.1.170 - QUALCOMM)

Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 11.0.10 - Dell Inc.)

RapidMiner 5 (HKCU\...\RapidMiner 5) (Version: 5.3 - )

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6267 - Realtek Semiconductor Corp.)

RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.27.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.27.0 - Renesas Electronics Corporation) Hidden

RPG MAKER VX Ace (HKLM-x32\...\RPG MAKER VX Ace_is1) (Version: 1.01a - )

RPG MAKER VX Ace RTP (HKLM-x32\...\RPGVXAce_RTP_is1) (Version: 1.00 - Enterbrain)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden

Service Pack 2 für SQL Server 2008 R2 (KB2630458) (64-bit) (HKLM\...\KB2630458) (Version: 10.52.4000.0 - Microsoft Corporation)

Shared Add-in Extensibility Update for Microsoft .NET Framework 2.0 (KB908002) (HKLM-x32\...\{09959E11-AD5D-408E-96AF-E3346954D6B8}) (Version: 1.0.0 - Microsoft)

Shared Add-in Support Update for Microsoft .NET Framework 2.0 (KB908002) (HKLM-x32\...\{64F3B15C-24C7-4B2B-9B72-65CCBBD7F06B}) (Version: 1.0.0 - Microsoft)

SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden

soft Xpansion Perfect PDF 7 Premium (HKLM-x32\...\{E573CB4A-056B-494C-8E5D-90D7151B584E}) (Version: 7.2.1.9 - soft Xpansion)

SQL Server 2008 R2 SP2 Common Files (Version: 10.52.4000.0 - Microsoft Corporation) Hidden

SQL Server 2008 R2 SP2 Database Engine Services (Version: 10.52.4000.0 - Microsoft Corporation) Hidden

SQL Server 2008 R2 SP2 Database Engine Shared (Version: 10.52.4000.0 - Microsoft Corporation) Hidden

SQL Server 2008 R2 SP2 Management Studio (Version: 10.52.4000.0 - Microsoft Corporation) Hidden

Sql Server Customer Experience Improvement Program (Version: 10.50.1600.1 - Microsoft Corporation) Hidden

Steganos Online Shield (HKLM-x32\...\{896614ED-00BD-4E0C-99AB-01C76EE416D9}) (Version: 1.0.4 - Steganos Software GmbH)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.6.0 - Synaptics Incorporated)

Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (HKLM\...\{6AF73222-EE90-434C-AE7E-B96F70A68D89}) (Version: 10.1.2731.0 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2473228) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2836939v3) (Version: 3 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2836939v3) (Version: 3 - Microsoft Corporation)

Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)

Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)

Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)

Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)

Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version:  - Microsoft)

Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)

Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{81812245-FC84-426A-BC02-6659C88CC7B2}) (Version:  - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{80F56E3F-1D47-4E45-B6E0-FEF4E919F4F9}) (Version:  - Microsoft)

Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)

Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)

Update for Microsoft Visio 2010 (KB2878227) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5D357893-40BA-4323-86BA-D97C66CD72F4}) (Version:  - Microsoft)

Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version:  - Microsoft)

VMware Workstation (HKLM-x32\...\{A3FF5CB2-FB35-4658-8751-9EDE1D65B3AA}) (Version: 6.5.1.5078 - VMware, Inc.)

windata 8 (HKLM-x32\...\{5AA41640-7B32-48C7-AD5C-7370256650D7}) (Version: 08.08.0000 - windata GmbH & Co.KG)

Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
 

==================== Restore Points  =========================
 

04-04-2014 04:40:09 Windows Update

29-05-2014 14:56:41 DirectX wurde installiert
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {174D1D17-53C2-4FE3-B4A5-9DBA82E6400A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-07-27] (Microsoft Corporation)

Task: {61F2F489-2EC5-453C-B5F1-BF9C632E07A2} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-07-27] (Microsoft Corporation)

Task: {A3E75CF9-C4FA-4DD4-835A-F490B3EBBE90} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-06-19] (Microsoft Corporation)
 

==================== Loaded Modules (whitelisted) =============
 

2011-11-19 13:14 - 2014-05-20 04:44 - 00014280 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll

2011-11-18 17:01 - 2011-05-28 23:05 - 00164864 _____ () C:\Program Files\Bearbeitungstools\WinRAR\rarext.dll

2011-11-19 13:10 - 2010-11-29 05:34 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2011-10-19 19:23 - 2007-11-29 17:35 - 00089600 _____ () D:\Benutzer\Mariano\Portable Anwendungen\CLCL\CLCL.exe

2013-12-31 01:25 - 2008-01-04 14:55 - 01391616 _____ () D:\Benutzer\Mariano\Downloads\Easytoolz\EasyToolz.exe

2014-02-24 21:55 - 2014-02-15 22:03 - 02208768 _____ () D:\Benutzer\Mariano\Portable Anwendungen\Scribble Papers\ScPapers.exe

2011-11-19 13:14 - 2014-05-20 04:44 - 00012120 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll

2011-10-19 19:23 - 2007-11-29 17:35 - 00012800 _____ () D:\Benutzer\Mariano\Portable Anwendungen\CLCL\tool_utl.dll

2011-10-19 19:23 - 2007-11-29 17:35 - 00011776 _____ () D:\Benutzer\Mariano\Portable Anwendungen\CLCL\tool_find.dll

2011-10-19 19:23 - 2007-11-29 17:35 - 00016384 _____ () D:\Benutzer\Mariano\Portable Anwendungen\CLCL\tool_text.dll

2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2014-07-27 11:31 - 2014-07-27 11:31 - 00043008 _____ () d:\benutzer\mariano\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp8la7po.dll

2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\libcef.dll

2014-06-19 12:39 - 2014-06-06 20:40 - 00461120 _____ () D:\Benutzer\Mariano\Portable Anwendungen\PhraseExpress 10.1.57 Portable\pexlang.dll

2012-08-27 22:33 - 2012-08-27 22:33 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2012-08-27 22:33 - 2012-08-27 22:33 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2012-12-19 21:28 - 2012-04-11 20:06 - 01186816 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\TMSlite160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 00087552 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspropsaver160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 02478080 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vsvector160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 04680704 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfcore160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 02693120 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\BBlite160.bpl

2012-12-19 21:28 - 2012-02-23 16:11 - 00025088 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vstrees160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 00064512 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vsprinters160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 00064512 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfprinter160.bpl

2012-12-19 21:28 - 2011-09-30 19:10 - 00684032 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\js32.dll

2012-12-19 21:28 - 2012-04-11 20:06 - 00097280 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\expertpdfcore160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 02253824 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\PKIECtrl160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 00517120 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfeditor160.bpl

2014-06-15 20:52 - 2014-06-15 20:52 - 03022960 _____ () D:\Benutzer\Mariano\Portable Anwendungen\ThunderbirdPortable\App\Thunderbird\mozjs.dll

2014-06-15 20:52 - 2014-06-15 20:52 - 00158832 _____ () D:\Benutzer\Mariano\Portable Anwendungen\ThunderbirdPortable\App\Thunderbird\NSLDAP32V60.dll

2014-06-15 20:52 - 2014-06-15 20:52 - 00023152 _____ () D:\Benutzer\Mariano\Portable Anwendungen\ThunderbirdPortable\App\Thunderbird\NSLDAPPR32V60.dll

2014-06-18 21:59 - 2014-06-18 21:59 - 03852912 _____ () D:\Benutzer\Mariano\Portable Anwendungen\FirefoxPortable\App\Firefox\mozjs.dll

2013-05-30 10:41 - 2013-05-30 10:41 - 16033160 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll

2014-07-27 13:10 - 2014-07-27 13:10 - 00011264 _____ () D:\Benutzer\Mariano\AppData\Local\Temp\nsc8F76.tmp\System.dll

2014-07-27 13:10 - 2014-07-27 13:10 - 00008704 _____ () D:\Benutzer\Mariano\AppData\Local\Temp\nsc8F76.tmp\newadvsplash.dll

2014-07-27 13:10 - 2014-07-27 13:10 - 00029696 _____ () D:\Benutzer\Mariano\AppData\Local\Temp\nsc8F76.tmp\registry.dll

2014-03-28 11:35 - 2014-03-28 11:35 - 00018207 _____ () D:\Benutzer\Mariano\Portable Anwendungen\FileZillaPortable\App\FileZilla\mingwm10.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\Windows\SysWOW64\zlib.dll:DocumentSummaryInformation

AlternateDataStreams: C:\Windows\SysWOW64\zlib.dll:SummaryInformation

AlternateDataStreams: C:\Windows\SysWOW64\zlib.dll:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DataIglooService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DFServ => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DataIglooService => ""="Service"
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

==================== Faulty Device Manager Devices =============
 

Name: 

Description: 

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (07/27/2014 00:13:11 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (07/27/2014 11:31:31 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/29/2014 04:53:43 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/29/2014 02:44:23 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/22/2014 10:17:21 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/22/2014 10:17:15 PM) (Source: NvStreamSvc) (EventID: 1) (User: )

Description: NvStreamSvcNvVAD initialization failed [6]
 

Error: (04/22/2014 10:17:15 PM) (Source: NvStreamSvc) (EventID: 1) (User: )

Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]
 

Error: (04/22/2014 10:17:15 PM) (Source: NvStreamSvc) (EventID: 1) (User: )

Description: NvStreamSvcNvVAD endpoint registration failed [0]
 

Error: (04/22/2014 10:05:15 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/13/2014 00:09:44 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (07/27/2014 11:30:09 AM) (Source: BugCheck) (EventID: 1001) (User: )

Description: 0x0000009f (0x0000000000000003, 0xfffffa8006d294d0, 0xfffff80000b9c3d8, 0xfffffa800c0585f0)C:\Windows\MEMORY.DMP072714-17986-01
 

Error: (05/29/2014 02:44:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "VMware Authorization Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (05/29/2014 02:44:02 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst VMware Authorization Service erreicht.
 

Error: (05/29/2014 02:42:48 PM) (Source: BugCheck) (EventID: 1001) (User: )

Description: 0x0000009f (0x0000000000000003, 0xfffffa80076d1a00, 0xfffff80000b9c3d8, 0xfffffa800d092010)C:\Windows\MEMORY.DMP052914-18673-01
 

Error: (04/22/2014 10:05:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "VMware Authorization Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (04/22/2014 10:05:03 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst VMware Authorization Service erreicht.
 

Error: (04/13/2014 11:35:02 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
 

Error: (04/13/2014 11:28:54 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "VMware Authorization Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (04/13/2014 11:28:54 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst VMware Authorization Service erreicht.
 

Error: (04/13/2014 10:08:53 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
 
 

Microsoft Office Sessions:

=========================

Error: (07/27/2014 00:13:11 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (07/27/2014 11:31:31 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/29/2014 04:53:43 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/29/2014 02:44:23 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/22/2014 10:17:21 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/22/2014 10:17:15 PM) (Source: NvStreamSvc) (EventID: 1) (User: )

Description: NvStreamSvcNvVAD initialization failed [6]
 

Error: (04/22/2014 10:17:15 PM) (Source: NvStreamSvc) (EventID: 1) (User: )

Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]
 

Error: (04/22/2014 10:17:15 PM) (Source: NvStreamSvc) (EventID: 1) (User: )

Description: NvStreamSvcNvVAD endpoint registration failed [0]
 

Error: (04/22/2014 10:05:15 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/13/2014 00:09:44 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 47%

Total physical RAM: 8086.17 MB

Available physical RAM: 4211.02 MB

Total Pagefile: 16170.52 MB

Available Pagefile: 11747.52 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: (Mano) (Fixed) (Total:97.65 GB) (Free:11.73 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (Mariano) (Fixed) (Total:600.88 GB) (Free:44.82 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 07F2837E)

Partition 1: (Not Active) - (Size=102 MB) - (Type=DE)

Partition 2: (Active) - (Size=98 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=601 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Danke dir und Grüße
Mariano

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo Schrauber,

alle Schritte sind erledigt und hier sind die erforderlichen Logs.

mbam.txt:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 27.07.2014

Suchlauf-Zeit: 15:35:52

Logdatei: mbam.txt

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.07.27.05

Rootkit Datenbank: v2014.07.17.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: Mariano
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 313333

Verstrichene Zeit: 7 Min, 46 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 3

PUP.Optional.Outobox.A, HKU\S-1-5-21-4278949540-2208170464-1142639898-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\outobox, In Quarantäne, [e99864401c5f8ea874a28c8e7f8546ba], 

PUP.Optional.Softonic.A, HKU\S-1-5-21-4278949540-2208170464-1142639898-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, In Quarantäne, [bec35f4523586bcb0212d311649e20e0], 

PUP.Optional.Somoto.A, HKU\S-1-5-21-4278949540-2208170464-1142639898-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOMOTO\SDP, In Quarantäne, [c3be4064cead94a2ecd60d02956f619f], 
 

Registrierungswerte: 1

PUP.Optional.Somoto.A, HKU\S-1-5-21-4278949540-2208170464-1142639898-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOMOTO\SDP|affid, dynamac, In Quarantäne, [c3be4064cead94a2ecd60d02956f619f]
 

Registrierungsdaten: 1

PUP.Optional.Conduit, HKU\S-1-5-21-4278949540-2208170464-1142639898-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com?SearchSource=10&CUI=UN13394157651797316&UM=2&ctid=CT3317892, Gut: (www.google.com), Schlecht: (hxxp://search.conduit.com?SearchSource=10&CUI=UN13394157651797316&UM=2&ctid=CT3317892),Ersetzt,[572a861ef883a98d05d98a2b8381e41c]
 

Ordner: 5

PUP.Optional.OpenCandy, D:\Benutzer\Mariano\AppData\Roaming\OpenCandy, In Quarantäne, [6c15aafacbb0cd69a14ab9eff70b23dd], 

PUP.Optional.OpenCandy, D:\Benutzer\Mariano\AppData\Roaming\OpenCandy\91FA2D5FD6214544BB082FEFB91BB190, In Quarantäne, [6c15aafacbb0cd69a14ab9eff70b23dd], 

PUP.Optional.OpenCandy, D:\Benutzer\Mariano\AppData\Roaming\OpenCandy\DEA7DF867D9741DD8FE953DBAD2D917F, In Quarantäne, [6c15aafacbb0cd69a14ab9eff70b23dd], 

PUP.Optional.OpenCandy, D:\Benutzer\Mariano\AppData\Roaming\OpenCandy\FF183090649B4D3BB027DD4F96F9E122, In Quarantäne, [6c15aafacbb0cd69a14ab9eff70b23dd], 

PUP.Optional.FilesFrog.A, D:\Benutzer\Mariano\AppData\Local\FilesFrog Update Checker, In Quarantäne, [156c83211e5d6acc1c268227b250ec14], 
 

Dateien: 16

PUP.Optional.OpenCandy.A, D:\Benutzer\Mariano\AppData\Roaming\OpenCandy\91FA2D5FD6214544BB082FEFB91BB190\LatestDLMgr.exe, In Quarantäne, [b4cd34703e3d87aff538eb3db64b7e82], 

PUP.Optional.OpenCandy.A, D:\Benutzer\Mariano\AppData\Roaming\OpenCandy\DEA7DF867D9741DD8FE953DBAD2D917F\LatestDLMgr.exe, In Quarantäne, [8100752fcdae78be022bf731956c7c84], 

PUP.Optional.OpenCandy.A, D:\Benutzer\Mariano\AppData\Roaming\OpenCandy\FF183090649B4D3BB027DD4F96F9E122\LatestDLMgr.exe, In Quarantäne, [81005f456318b87e0c21ec3cc8396997], 

PUP.Optional.Amonetize, D:\Benutzer\Mariano\AppData\Roaming\OpenCandy\FF183090649B4D3BB027DD4F96F9E122\WS_p4v2_2CB2.exe, In Quarantäne, [a7da7e264b3070c6eb6e9ddcc53ffc04], 

PUP.Optional.OpenCandy, D:\Benutzer\Mariano\Downloads\MyPhoneExplorer_Setup_1.8.4.exe, In Quarantäne, [dfa27d27cfac13237b0b716a966e41bf], 

Trojan.Agent.CK, D:\Benutzer\Mariano\Downloads\WinRar.v4.01.de.zip, In Quarantäne, [374a673d304bed49c121ae2aca3748b8], 

PUP.Optional.Conduit.A, D:\Benutzer\Mariano\AppData\Local\Conduit\CT3317892\RadioTotal1AutoUpdateHelper.exe, In Quarantäne, [552c3c68c3b88fa7133885998c744eb2], 

PUP.Optional.Amonetize, D:\Benutzer\Mariano\AppData\Local\DownloadGuide\Offers\launcher.exe, In Quarantäne, [5b261f8565166fc7b23f1c18c83829d7], 

PUP.Optional.Conduit.A, D:\Benutzer\Mariano\AppData\Local\DownloadGuide\Offers\mconduitinstaller.exe, In Quarantäne, [99e83e66cab140f6fcfbe03e49b737c9], 

PUP.Optional.Wajam.A, D:\Benutzer\Mariano\AppData\Local\DownloadGuide\Offers\wajam_download.exe, In Quarantäne, [92eff3b1413afb3b060c2c1b12ee60a0], 

PUP.Optional.Somoto, D:\Benutzer\Mariano\AppData\Local\FilesFrog Update Checker\uninstall.exe, In Quarantäne, [1b66554f5f1c8fa7c34b9097ae52e020], 

PUP.Optional.OpenCandy, D:\Benutzer\Mariano\AppData\Roaming\OpenCandy\91FA2D5FD6214544BB082FEFB91BB190\Setup1004733_DE-2.exe, In Quarantäne, [6c15aafacbb0cd69a14ab9eff70b23dd], 

PUP.Optional.OpenCandy, D:\Benutzer\Mariano\AppData\Roaming\OpenCandy\91FA2D5FD6214544BB082FEFB91BB190\Trial-14.0.1000.89_de-DE_1004733_DE-2.exe, In Quarantäne, [6c15aafacbb0cd69a14ab9eff70b23dd], 

PUP.Optional.OpenCandy, D:\Benutzer\Mariano\AppData\Roaming\OpenCandy\DEA7DF867D9741DD8FE953DBAD2D917F\Setup1004733_DE-2.exe, In Quarantäne, [6c15aafacbb0cd69a14ab9eff70b23dd], 

PUP.Optional.OpenCandy, D:\Benutzer\Mariano\AppData\Roaming\OpenCandy\DEA7DF867D9741DD8FE953DBAD2D917F\Trial-14.0.1000.89_de-DE_1004733_DE-2.exe, In Quarantäne, [6c15aafacbb0cd69a14ab9eff70b23dd], 

PUP.Optional.FilesFrog.A, D:\Benutzer\Mariano\AppData\Local\FilesFrog Update Checker\update_checker.exe, In Quarantäne, [156c83211e5d6acc1c268227b250ec14], 
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

AdwCleaner[S0].txt:

Code:

# AdwCleaner v3.216 - Bericht erstellt am 27/07/2014 um 15:52:25

# Aktualisiert 17/07/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Mariano - MARIANO-LAPTOP

# Gestartet von : D:\Benutzer\Mariano\Desktop\adwcleaner_3.216.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : D:\Benutzer\Mariano\AppData\Local\Conduit

Ordner Gelöscht : D:\Benutzer\Mariano\AppData\Local\DownloadGuide

Ordner Gelöscht : D:\Benutzer\Mariano\AppData\Local\eSupport.com

Ordner Gelöscht : D:\Benutzer\Mariano\AppData\Local\Media Get LLC

Ordner Gelöscht : D:\Benutzer\Mariano\AppData\Local\MediaGet2

Ordner Gelöscht : D:\Benutzer\Mariano\AppData\Local\PackageAware

Ordner Gelöscht : D:\Benutzer\Mariano\AppData\Local\Temp\OCS

Ordner Gelöscht : D:\Benutzer\Mariano\AppData\LocalLow\Conduit

Ordner Gelöscht : D:\Benutzer\Mariano\AppData\Roaming\OCS

Ordner Gelöscht : D:\Benutzer\Mariano\AppData\Roaming\pdfforge

Datei Gelöscht : D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\foxydeal.sqlite

Datei Gelöscht : D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\user.js
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Schlüssel Gelöscht : HKCU\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\Somoto

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Show-Password

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
 

***** [ Browser ] *****
 

-\\ Internet Explorer v0.0.0.0
 
 

-\\ Mozilla Firefox v
 

[ Datei : D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\prefs.js ]
 
 

*************************
 

AdwCleaner[R0].txt - [2458 octets] - [27/07/2014 15:51:23]

AdwCleaner[S0].txt - [2183 octets] - [27/07/2014 15:52:25]
 

########## EOF - D:\AdwCleaner\AdwCleaner[S0].txt - [2243 octets] ##########

JRT.txt:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Home Premium x64

Ran by Mariano on 27.07.2014 at 15:58:20,11

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{BDA29CAD-38C8-4BFC-85E9-D14EC4AC83C8}
 
 
 

~~~ Files
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "D:\Benutzer\Mariano\AppData\Roaming\thinstall"
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 27.07.2014 at 16:06:06,87

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST.txt:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014

Ran by Mariano (administrator) on MARIANO-LAPTOP on 27-07-2014 16:07:09

Running from D:\Benutzer\Mariano\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Faronics Corporation) C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DFServ.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(COMODO) C:\Program Files\Internettools\COMODO\COMODO Internet Security\cmdagent.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Microsoft Corporation) D:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Faronics Corporation) C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe

(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Steganos Software GmbH) C:\Program Files (x86)\Steganos Online Shield\OnlineShieldService.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(DT Soft Ltd) C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTAgent.exe

(Jedox AG) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo\palo.exe

(Apache Software Foundation) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\httpd.exe

(Jedox AG) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\palo\palo.exe

(Apache Software Foundation) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\tomcat\bin\paloTomcat6.exe

(QUALCOMM, Inc.) C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kDell.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(DT Soft Ltd) C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTShellHlp.exe

(Ericsson AB) C:\Program Files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe

(Steganos Software GmbH) C:\Program Files (x86)\Steganos Online Shield\OnlineShieldClient.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(VMware, Inc.) C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-authd.exe

(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe

(Dell) D:\Benutzer\Mariano\AppData\Local\Apps\2.0\TLWZ2CG6.15O\62DQ7C9Q.K6T\dell..tion_0f612f649c4a10af_0005.0006_f9e15713f5aac8ac\DellSystemDetect.exe

(SoftBureau.com) C:\Program Files (x86)\CD Locker\CDLocker.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Apache Software Foundation) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\httpd.exe

(Dropbox, Inc.) D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\Dropbox.exe

() D:\Benutzer\Mariano\Downloads\Easytoolz\EasyToolz.exe

(Bartels Media GmbH) D:\Benutzer\Mariano\Portable Anwendungen\PhraseExpress 10.1.57 Portable\phraseexpress.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Apple Inc.) C:\Program Files (x86)\Playertools\iTunes\iTunesHelper.exe

(Visagesoft) C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfprsrv.exe

(VMware, Inc.) C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-tray.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Windows\splwow64.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6561384 2010-12-14] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2010-12-10] (Realtek Semiconductor)

HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [4479648 2011-01-25] (Dell Inc.)

HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\Internettools\COMODO\COMODO Internet Security\cfp.exe [9577680 2012-11-08] (COMODO)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2531624 2010-12-17] (Synaptics Incorporated)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" 

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart 

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\Playertools\iTunes\iTunesHelper.exe [421776 2012-09-10] (Apple Inc.)

HKLM-x32\...\Run: [vspdfprsrv.exe] => C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfprsrv.exe [6082560 2012-04-23] (Visagesoft)

HKLM-x32\...\Run: [vmware-tray] => C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-tray.exe [96816 2008-10-29] (VMware, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

Winlogon\Notify\DfLogon: LogonDll.dll [X]

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTAgent.exe [4527424 2011-08-17] (DT Soft Ltd)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [CCWinTray] => C:\Windows\tray\wintmr.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [SOS_Agent] => C:\Program Files (x86)\Steganos Online Shield\OnlineShieldClient.exe [4493536 2013-05-16] (Steganos Software GmbH)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [Free CD/DVD Guard] => C:\Program Files (x86)\Free CD-DVD Guard\cddg.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [DellSystemDetect] => D:\Benutzer\Mariano\AppData\Local\Apps\2.0\TLWZ2CG6.15O\62DQ7C9Q.K6T\dell..tion_0f612f649c4a10af_000 (the data entry has 45 more characters).

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {6c175d68-4d4a-11e3-a6e9-005056c00008} - G:\.\Setup.exe AUTORUN=1

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {6c175d88-4d4a-11e3-a6e9-005056c00008} - G:\.\Setup.exe AUTORUN=1

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {b1b7974c-11d9-11e1-b387-806e6f6e6963} - F:\autoRcd.exe

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {ffe51fc2-b8a5-11e2-bba9-005056c00008} - G:\AutoRun.exe

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {ffe51fdf-b8a5-11e2-bba9-005056c00008} - G:\AutoRun.exe

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-05-20] (NVIDIA Corporation)

AppInit_DLLs:  C:\Windows\system32\guard64.dll => C:\Windows\system32\guard64.dll [390392 2012-11-08] (COMODO)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-05-20] (NVIDIA Corporation)

AppInit_DLLs-x32:  C:\Windows\SysWOW64\guard32.dll => C:\Windows\SysWOW64\guard32.dll [301264 2012-11-08] (COMODO)

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EasyToolz.lnk

ShortcutTarget: EasyToolz.lnk -> D:\Benutzer\Mariano\Downloads\Easytoolz\EasyToolz.exe ()

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk

ShortcutTarget: PhraseExpress.lnk -> D:\Benutzer\Mariano\Portable Anwendungen\PhraseExpress 10.1.57 Portable\phraseexpress.exe (Bartels Media GmbH)

ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

BootExecute: autocheck autochk /k:C /k:D * 
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com

URLSearchHook: HKCU - (No Name) - {422f7661-9403-4da4-b4ef-cc3e268817b5} - No File

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKCU - {0C0959A2-B193-4209-8431-E81BE6AE5205} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {6E7B2DC4-58AD-48AB-9351-176746EFEA87} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {86D6A1A3-AF61-4326-B4A4-085589A36AFD} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {A15D9866-E120-4E4D-A7AA-4E24ED726EFB} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {C7764045-5997-4A9C-A30C-866C6AF7A45F} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {E1EE7EFD-6157-4437-A45B-70D1F3E75749} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->  No File

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Perfect PDF 7 - {277BA090-1A90-4EDD-8F61-6574E274F50A} - C:\Program Files (x86)\Bearbeitungstools\Perfect PDF 7\ieagent64.dll (soft Xpansion)

Toolbar: HKLM-x32 - Perfect PDF 7 - {277BA090-1A90-4EDD-8F61-6574E274F50A} - C:\Program Files (x86)\Bearbeitungstools\Perfect PDF 7\ieagent32.dll (soft Xpansion)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default

FF Homepage: www.google.de

FF NetworkProxy: "backup.ftp", ""

FF NetworkProxy: "backup.ftp_port", 0

FF NetworkProxy: "backup.socks", ""

FF NetworkProxy: "backup.socks_port", 0

FF NetworkProxy: "backup.ssl", ""

FF NetworkProxy: "backup.ssl_port", 0

FF NetworkProxy: "ftp", "200.130.146.35"

FF NetworkProxy: "ftp_port", 80

FF NetworkProxy: "http", "200.130.146.35"

FF NetworkProxy: "http_port", 80

FF NetworkProxy: "share_proxy_settings", true

FF NetworkProxy: "socks", "200.130.146.35"

FF NetworkProxy: "socks_port", 80

FF NetworkProxy: "ssl", "200.130.146.35"

FF NetworkProxy: "ssl_port", 80

FF NetworkProxy: "type", 4

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\Playertools\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\BEARBE~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @soft-xpansion/npsxpdf - C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll (soft-Xpansion)

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{0911546D-894C-4426-8EA0-1F403CA32652}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{7F915D2E-7D07-4CF2-9B7E-B3E7D61CB861}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{81D5A205-FC3F-424B-9B01-509CD9A18B37}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{87245C8D-940D-4713-8A08-0E6E8B9E78E4}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{D4856139-5791-401C-AC00-CAF7B8984560}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{EEED5176-DC4F-4474-9F79-2C171AC02607}.xml

FF Extension: ProxTube - Unblock YouTube - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\ich@maltegoetz.de [2013-12-13]

FF Extension: Adblock Plus Pop-up Addon - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\adblockpopups@jessehakanen.net.xpi [2013-02-24]

FF Extension: Firebug - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\firebug@software.joehewitt.com.xpi [2012-04-23]

FF Extension: FlashGot - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2014-02-07]

FF Extension: CoolPreviews - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}.xpi [2013-02-24]

FF Extension: Adblock Plus - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-24]

FF Extension: Download Statusbar - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2012-01-19]

FF HKLM-x32\...\Firefox\Extensions: [{9C163D15-E392-44d7-BAF5-B8278E005611}] - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb

FF Extension: soft Xpansion Perfect PDF 7 - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb [2013-08-19]

FF HKLM-x32\...\Thunderbird\Extensions: [{9C163D15-E392-44d7-BAF5-B8278E005611}] - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb

FF HKCU\...\Firefox\Extensions: [{cc5a9034-5e34-43a4-ab29-98b939fa1a74}] - C:\Program Files (x86)\Show-Password\136.xpi

FF StartMenuInternet: FIREFOX.EXE - D:\Benutzer\Mariano\Portable Anwendungen\FirefoxPortable\App\Firefox\firefox.exe
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2266296 2014-05-16] (Microsoft Corporation)

R2 cmdAgent; C:\Program Files\Internettools\COMODO\COMODO Internet Security\cmdagent.exe [2828408 2012-11-08] (COMODO)

S3 DataIglooService; C:\Program Files (x86)\Bearbeitungstools\Faronics\Data Igloo Standard\DIService.exe [154384 2010-12-08] (Faronics Corporation)

R2 DFServ; C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DFServ.exe [1075200 2011-09-01] (Faronics Corporation) [File not signed]

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)

R2 MSSQLSERVER; d:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe [62218696 2012-06-29] (Microsoft Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] ()

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1618888 2014-04-30] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21009352 2014-04-30] (NVIDIA Corporation)

R2 Online Shield Starter Service; C:\Program Files (x86)\Steganos Online Shield\OnlineShieldService.exe [303368 2013-05-16] (Steganos Software GmbH)

R2 PaloServerService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo\palo.exe [11776 2011-08-04] (Jedox AG) [File not signed]

R2 PaloSuiteHttpdService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\httpd.exe [20549 2010-10-18] (Apache Software Foundation) [File not signed]

R2 PaloSuiteMolapService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\palo\palo.exe [11776 2011-08-04] (Jedox AG) [File not signed]

R2 PaloSuiteTomcatService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\tomcat\bin\paloTomcat6.exe [57344 2011-06-30] (Apache Software Foundation) [File not signed]

S2 PaloWebCoreService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\core3\core.exe [1944576 2011-07-25] (Jedox AG) [File not signed]

R2 QDLService2kDell; C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kDell.exe [331512 2010-06-25] (QUALCOMM, Inc.)

S4 SQLSERVERAGENT; d:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE [441288 2012-06-29] (Microsoft Corporation)

S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-08-19] (soft Xpansion)

S3 ufad-ws60; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-ufad.exe [191024 2008-10-02] (VMware, Inc.)

R2 VMAuthdService; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-authd.exe [113200 2008-10-29] (VMware, Inc.)

R2 WMCoreService; C:\Program Files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe [463912 2010-08-18] (Ericsson AB)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [584056 2012-11-08] (COMODO)

R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [38144 2012-11-08] (COMODO)

R0 DeepFrz; C:\Windows\System32\Drivers\DeepFrz.sys [234520 2011-09-01] (Faronics Corporation)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [271424 2011-11-19] (DT Soft Ltd)

R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37392 2010-05-20] (Paragon Software Group)

R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [94288 2012-11-08] (COMODO)

R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [301512 2014-05-20] (NVIDIA Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19744 2014-04-30] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

S4 RsFx0153; C:\Windows\System32\DRIVERS\RsFx0153.sys [321992 2012-06-29] (Microsoft Corporation)

R2 vstor2-ws60; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vstor2-ws60.sys [32816 2008-10-02] (VMware, Inc.)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-07-27 16:07 - 2014-07-27 16:07 - 00028950 _____ () D:\Benutzer\Mariano\Desktop\FRST.txt

2014-07-27 16:07 - 2014-07-27 16:07 - 00000000 ____D () C:\FRST

2014-07-27 16:06 - 2014-07-27 16:06 - 00000990 _____ () D:\Benutzer\Mariano\Desktop\JRT.txt

2014-07-27 15:58 - 2014-07-27 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-07-27 15:56 - 2014-07-27 15:56 - 00002323 _____ () D:\Benutzer\Mariano\Desktop\AdwCleaner[S0].txt

2014-07-27 15:50 - 2014-07-27 15:50 - 00005583 _____ () D:\Benutzer\Mariano\Desktop\mbam.txt

2014-07-27 15:33 - 2014-07-27 15:49 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-27 15:33 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-07-27 15:33 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-07-27 15:33 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-07-27 15:30 - 2014-07-27 15:31 - 00000000 ____D () D:\Benutzer\Mariano\Desktop\Trojaner Log

2014-07-27 15:29 - 2014-07-27 15:29 - 01016261 _____ (Thisisu) D:\Benutzer\Mariano\Desktop\JRT.exe

2014-07-27 15:28 - 2014-07-27 15:28 - 01354223 _____ () D:\Benutzer\Mariano\Desktop\adwcleaner_3.216.exe

2014-07-27 15:27 - 2014-07-27 16:06 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\Trojaner-Board

2014-07-27 15:18 - 2014-07-27 15:18 - 01029760 _____ () C:\Windows\Minidump\072714-17409-01.dmp

2014-07-27 15:01 - 2014-07-27 15:01 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\CrashDumps

2014-07-27 14:56 - 2014-07-27 15:03 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\NPE

2014-07-27 13:58 - 2014-07-27 13:58 - 02093568 _____ (Farbar) D:\Benutzer\Mariano\Desktop\FRST64.exe

2014-07-27 13:11 - 2014-07-27 13:11 - 05981830 _____ (Tim Kosse) D:\Benutzer\Mariano\Downloads\FileZilla_3.9.0.1_win32-setup.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-07-27 16:07 - 2014-07-27 16:07 - 00028950 _____ () D:\Benutzer\Mariano\Desktop\FRST.txt

2014-07-27 16:07 - 2014-07-27 16:07 - 00000000 ____D () C:\FRST

2014-07-27 16:06 - 2014-07-27 16:06 - 00000990 _____ () D:\Benutzer\Mariano\Desktop\JRT.txt

2014-07-27 16:06 - 2014-07-27 15:27 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\Trojaner-Board

2014-07-27 16:02 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-27 16:02 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-27 15:59 - 2011-11-18 13:40 - 01393249 _____ () C:\Windows\WindowsUpdate.log

2014-07-27 15:58 - 2014-07-27 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-07-27 15:57 - 2011-11-21 21:19 - 00000000 ___RD () D:\Benutzer\Mariano\Dropbox

2014-07-27 15:57 - 2011-11-19 14:11 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Roaming\Dropbox

2014-07-27 15:56 - 2014-07-27 15:56 - 00002323 _____ () D:\Benutzer\Mariano\Desktop\AdwCleaner[S0].txt

2014-07-27 15:54 - 2013-12-31 01:26 - 00001576 _____ () D:\Benutzer\Mariano\AppData\Roaming\EasyToolz.ini

2014-07-27 15:54 - 2011-11-18 20:23 - 00213668 _____ () C:\Windows\DFError.log

2014-07-27 15:54 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-27 15:54 - 2009-07-14 06:51 - 00040307 _____ () C:\Windows\setupact.log

2014-07-27 15:53 - 2010-11-21 05:47 - 00169654 _____ () C:\Windows\PFRO.log

2014-07-27 15:50 - 2014-07-27 15:50 - 00005583 _____ () D:\Benutzer\Mariano\Desktop\mbam.txt

2014-07-27 15:49 - 2014-07-27 15:33 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-27 15:45 - 2014-06-19 12:39 - 00000000 ____D () D:\Benutzer\Mariano\Documents\PhraseExpress

2014-07-27 15:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Branding

2014-07-27 15:33 - 2012-01-15 21:52 - 00000000 ____D () C:\Program Files (x86)\Systemtools

2014-07-27 15:31 - 2014-07-27 15:30 - 00000000 ____D () D:\Benutzer\Mariano\Desktop\Trojaner Log

2014-07-27 15:29 - 2014-07-27 15:29 - 01016261 _____ (Thisisu) D:\Benutzer\Mariano\Desktop\JRT.exe

2014-07-27 15:28 - 2014-07-27 15:28 - 01354223 _____ () D:\Benutzer\Mariano\Desktop\adwcleaner_3.216.exe

2014-07-27 15:18 - 2014-07-27 15:18 - 01029760 _____ () C:\Windows\Minidump\072714-17409-01.dmp

2014-07-27 15:18 - 2013-02-17 18:27 - 00000000 ____D () C:\Windows\Minidump

2014-07-27 15:15 - 2011-10-18 19:22 - 00000000 ____D () D:\Benutzer\Mariano\Portable Anwendungen

2014-07-27 15:03 - 2014-07-27 14:56 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\NPE

2014-07-27 15:01 - 2014-07-27 15:01 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\CrashDumps

2014-07-27 13:58 - 2014-07-27 13:58 - 02093568 _____ (Farbar) D:\Benutzer\Mariano\Desktop\FRST64.exe

2014-07-27 13:11 - 2014-07-27 13:11 - 05981830 _____ (Tim Kosse) D:\Benutzer\Mariano\Downloads\FileZilla_3.9.0.1_win32-setup.exe

2014-07-26 10:05 - 2011-11-19 14:11 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-07-20 22:34 - 2011-10-19 19:26 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\1-Click-Hoster

2014-07-05 11:57 - 2012-03-02 19:31 - 00002004 ____H () D:\Benutzer\Mariano\Documents\Default.rdp
 

Some content of TEMP:

====================

D:\Benutzer\Mariano\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpeehjtc.dll

D:\Benutzer\Mariano\AppData\Local\Temp\nvSCPAPI.dll

D:\Benutzer\Mariano\AppData\Local\Temp\nvStInst.exe

D:\Benutzer\Mariano\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-04-04 02:16
 

==================== End Of Log ============================

--- --- ---

Addition.txt falls benötigt:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-07-2014

Ran by Mariano at 2014-07-27 16:07:56

Running from D:\Benutzer\Mariano\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: COMODO Defense+ (Enabled - Up to date) {FEEA52D5-051E-08DD-07EF-2F009097607D}

FW: COMODO Firewall (Enabled) {7DB03214-694B-060B-1600-BD4715C36DBB}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Adobe Flash Player 11 ActiveX 64-bit (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.1.102.55 - Adobe Systems Incorporated)

Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.7.700.202 - Adobe Systems Incorporated)

Age of Wonders III (HKLM-x32\...\GOGPACKAGEOFWONDERS3_is1) (Version: 2.0.0.4 - GOG.com)

Apple Application Support (HKLM-x32\...\{63EC2120-1742-4625-AA47-C6A8AEC9C64C}) (Version: 2.2.2 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}) (Version: 6.0.0.59 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Artisteer 3 (HKLM-x32\...\Artisteer 3) (Version: 3.0 - Extensoft)

Assassins Creed IV Black Flag Freedom Cry (HKLM-x32\...\QXNzYXNzaW5zQ3JlZWRJVkJsYWNrRmxhZw==_is1) (Version: 1 - )

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

CD Locker 1.0 (HKLM-x32\...\CD Locker) (Version: 1.0 - SoftBureau.com)

COMODO Internet Security (HKLM\...\{4EAB2511-0135-48CA-A47B-CE1E6836793A}) (Version: 5.8.15089.2124 - COMODO Security Solutions Inc.)

DAEMON Tools Pro (HKLM-x32\...\DAEMON Tools Pro) (Version: 4.41.0315.0262 - DT Soft Ltd)

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{92C42EDD-6524-4577-B2EB-6C68C63B6D4A}) (Version:  - Microsoft)

Dell System Detect (HKCU\...\9204f5692a8faf3b) (Version: 5.6.0.4 - Dell)

Dell Wireless HSPA Mini-Card Drivers (HKLM-x32\...\{9D583F01-A973-4B04-90BD-FB7886779090}) (Version: 6.1.26.6 - Dell)

Dropbox (HKCU\...\Dropbox) (Version: 2.10.3 - Dropbox, Inc.)

EASEUS Data Recovery Wizard Professional 5.0.1 (HKLM-x32\...\EASEUS Data Recovery Wizard Professional 5.0.1_is1) (Version:  - EASEUS)

Faronics Data Igloo Standard (HKLM-x32\...\{026A71FA-4117-45CF-BA98-8751E103CD22}) (Version: 1.31.1110.315 - Ihr Firmenname)

Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (HKLM-x32\...\{8343C2D8-09DF-38B3-9D1A-A26148918E45}.KB947789) (Version: 1 - Microsoft Corporation)

Intel PROSet Wireless (Version:  - ) Hidden

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2342 - Intel Corporation)

Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{BEE86606-EFB5-4353-9F34-29E0C59CDCFA}) (Version: 15.2.0.0284 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)

Intel® PROSet/Wireless WiFi-Software (HKLM\...\{181BBF43-CA17-4E1A-A78D-81E67A57B8A4}) (Version: 15.02.0000.1258 - Intel Corporation)

iTunes (HKLM\...\{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}) (Version: 10.7.0.21 - Apple Inc.)

Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

Java(TM) 6 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle)

Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)

Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2013 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 15.0.4615.1002 - Microsoft Corporation)

Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Report Viewer Redistributable 2008 (KB971119) (x32 Version: 9.0.30731 - Microsoft Corporation) Hidden

Microsoft Report Viewer Redistributable 2008 SP1 (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 (KB971119)) (Version:  - Microsoft Corporation)

Microsoft Report Viewer Redistributable 2008 SP1 Language Pack - DEU (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 SP1 Language Pack - DEU) (Version:  - Microsoft Corporation)

Microsoft Report Viewer Redistributable 2008 SP1 Language Pack - DEU (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden

Microsoft SQL Server 2008 R2 (64 Bit) (HKLM\...\Microsoft SQL Server 2008 R2) (Version:  - Microsoft Corporation)

Microsoft SQL Server 2008 R2 (64 Bit) (Version:  - Microsoft Corporation) Hidden

Microsoft SQL Server 2008 R2 Native Client (HKLM\...\{992B55F9-FD13-42C5-8B3C-B7E9F998A969}) (Version: 10.52.4000.0 - Microsoft Corporation)

Microsoft SQL Server 2008 R2 RsFx Driver (Version: 10.52.4000.0 - Microsoft Corporation) Hidden

Microsoft SQL Server 2008 R2-Richtlinien (HKLM-x32\...\{78033A38-50E2-4A65-823F-C1B34DF9FE41}) (Version: 10.50.1600.1 - Microsoft Corporation)

Microsoft SQL Server 2008 R2-Setup (Deutsch) (HKLM\...\{8E7A48F0-44F6-4ECD-86E1-C345CDD35791}) (Version: 10.52.4000.0 - Microsoft Corporation)

Microsoft SQL Server Browser (HKLM-x32\...\{8DD113A8-811A-404E-A4D7-443D014946AC}) (Version: 10.52.4000.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 Query Tools DEU (HKLM-x32\...\{3888A22E-1A9E-4DBE-A93B-42385141F37D}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft SQL Server VSS Writer (HKLM\...\{FBBA9369-3A6B-4EE3-9C53-DA0D29C2FC95}) (Version: 10.52.4000.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM-x32\...\{4ECF4BDC-8387-329A-ABE9-CF5798F84BB2}) (Version: 9.0.35191 - Microsoft Corporation)

Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (HKLM-x32\...\{8343C2D8-09DF-38B3-9D1A-A26148918E45}) (Version: 9.0.35191 - Microsoft Corporation)

NVIDIA 3D Vision Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)

NVIDIA GeForce Experience 2.0.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0.1 - NVIDIA Corporation)

NVIDIA Grafiktreiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.154.1168 - NVIDIA Corporation) Hidden

NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Optimus Update 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden

NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden

NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)

NVIDIA ShadowPlay 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden

NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden

NVIDIA Systemsteuerung 337.88 (Version: 337.88 - NVIDIA Corporation) Hidden

NVIDIA Update 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden

NVIDIA Update Core (Version: 12.4.67 - NVIDIA Corporation) Hidden

NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4615.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4615.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4615.1002 - Microsoft Corporation) Hidden

Palo for Excel 3.2 - Community Edition (HKLM-x32\...\{6B764F17-E232-4494-92DE-3ABC3FDE0C0E}_is1) (Version: 3.2.2.5096 - Jedox AG)

Palo Suite 3.2 - Community Edition (HKLM-x32\...\{125E8B3D-F78A-4525-80C2-E0E3ADCE12D9}_is1) (Version: 3.2.4166.5160 - Jedox AG)

Paragon Partition Manager™ 11 Professional (HKLM-x32\...\{A35001F0-F1E4-11DD-A38B-005056C00008}) (Version: 90.00.0003 - Paragon Software)

PDF Experte 8 Ultimate (HKLM-x32\...\{FC279721-37A6-4777-AFD8-7A56681EBA14}) (Version: 8.0.0140.0 - Avanquest software)

Qualcomm Gobi 2000 Package for Dell (HKLM-x32\...\{55958FAE-1862-4EE5-96BB-B9309CACE1C0}) (Version: 1.1.170 - QUALCOMM)

Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 11.0.10 - Dell Inc.)

RapidMiner 5 (HKCU\...\RapidMiner 5) (Version: 5.3 - )

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6267 - Realtek Semiconductor Corp.)

RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.27.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.27.0 - Renesas Electronics Corporation) Hidden

RPG MAKER VX Ace (HKLM-x32\...\RPG MAKER VX Ace_is1) (Version: 1.01a - )

RPG MAKER VX Ace RTP (HKLM-x32\...\RPGVXAce_RTP_is1) (Version: 1.00 - Enterbrain)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden

Service Pack 2 für SQL Server 2008 R2 (KB2630458) (64-bit) (HKLM\...\KB2630458) (Version: 10.52.4000.0 - Microsoft Corporation)

Shared Add-in Extensibility Update for Microsoft .NET Framework 2.0 (KB908002) (HKLM-x32\...\{09959E11-AD5D-408E-96AF-E3346954D6B8}) (Version: 1.0.0 - Microsoft)

Shared Add-in Support Update for Microsoft .NET Framework 2.0 (KB908002) (HKLM-x32\...\{64F3B15C-24C7-4B2B-9B72-65CCBBD7F06B}) (Version: 1.0.0 - Microsoft)

SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden

soft Xpansion Perfect PDF 7 Premium (HKLM-x32\...\{E573CB4A-056B-494C-8E5D-90D7151B584E}) (Version: 7.2.1.9 - soft Xpansion)

SQL Server 2008 R2 SP2 Common Files (Version: 10.52.4000.0 - Microsoft Corporation) Hidden

SQL Server 2008 R2 SP2 Database Engine Services (Version: 10.52.4000.0 - Microsoft Corporation) Hidden

SQL Server 2008 R2 SP2 Database Engine Shared (Version: 10.52.4000.0 - Microsoft Corporation) Hidden

SQL Server 2008 R2 SP2 Management Studio (Version: 10.52.4000.0 - Microsoft Corporation) Hidden

Sql Server Customer Experience Improvement Program (Version: 10.50.1600.1 - Microsoft Corporation) Hidden

Steganos Online Shield (HKLM-x32\...\{896614ED-00BD-4E0C-99AB-01C76EE416D9}) (Version: 1.0.4 - Steganos Software GmbH)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.6.0 - Synaptics Incorporated)

Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (HKLM\...\{6AF73222-EE90-434C-AE7E-B96F70A68D89}) (Version: 10.1.2731.0 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2473228) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2836939v3) (Version: 3 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2836939v3) (Version: 3 - Microsoft Corporation)

Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)

Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)

Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)

Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)

Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version:  - Microsoft)

Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)

Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{81812245-FC84-426A-BC02-6659C88CC7B2}) (Version:  - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{80F56E3F-1D47-4E45-B6E0-FEF4E919F4F9}) (Version:  - Microsoft)

Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)

Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)

Update for Microsoft Visio 2010 (KB2878227) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5D357893-40BA-4323-86BA-D97C66CD72F4}) (Version:  - Microsoft)

Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version:  - Microsoft)

VMware Workstation (HKLM-x32\...\{A3FF5CB2-FB35-4658-8751-9EDE1D65B3AA}) (Version: 6.5.1.5078 - VMware, Inc.)

windata 8 (HKLM-x32\...\{5AA41640-7B32-48C7-AD5C-7370256650D7}) (Version: 08.08.0000 - windata GmbH & Co.KG)

Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4278949540-2208170464-1142639898-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
 

==================== Restore Points  =========================
 

04-04-2014 04:40:09 Windows Update

29-05-2014 14:56:41 DirectX wurde installiert
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {32035813-E7CE-43A5-8C78-B387003A70DE} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-05-29] (Microsoft Corporation)

Task: {D910FE21-B96E-49A4-B0AE-FE03E7D6EC5F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-05-29] (Microsoft Corporation)

Task: {E6DD5B67-B9D6-43F7-A7B0-1284FE245D0B} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-04-15] (Microsoft Corporation)
 

==================== Loaded Modules (whitelisted) =============
 

2011-11-19 13:14 - 2014-05-20 04:44 - 00014280 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll

2012-01-03 19:16 - 2014-05-20 03:25 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2012-02-08 20:57 - 2010-06-17 22:56 - 00087040 _____ () C:\Windows\System32\redmonnt.dll

2014-04-03 21:43 - 2013-10-31 18:13 - 00102568 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2013-06-19 17:31 - 2014-04-15 03:39 - 00630952 _____ () C:\Program Files\Microsoft Office 15\ClientX64\StreamServer.dll

2011-11-19 13:10 - 2010-11-29 05:34 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2013-12-31 01:25 - 2008-01-04 14:55 - 01391616 _____ () D:\Benutzer\Mariano\Downloads\Easytoolz\EasyToolz.exe

2011-11-18 17:01 - 2011-05-28 23:05 - 00164864 _____ () C:\Program Files\Bearbeitungstools\WinRAR\rarext.dll

2012-08-27 22:33 - 2012-08-27 22:33 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2012-08-27 22:33 - 2012-08-27 22:33 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2011-11-19 13:14 - 2014-05-20 04:44 - 00012120 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll

2011-11-27 15:04 - 2010-03-14 22:52 - 00077876 _____ () C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\zlib1.dll

2011-11-27 15:04 - 2011-01-08 01:26 - 00159744 _____ () C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\php\ext\eAccelerator_ts.dll

2011-11-27 15:04 - 2009-07-08 19:56 - 00065536 _____ () C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\php\ext\phpchartdir530.dll

2011-11-19 13:35 - 2010-02-17 13:20 - 00065576 ____R () C:\Program Files (x86)\Dell\Dell WWAN\WMCore\MBMDebug.dll

2008-10-29 00:08 - 2008-10-29 00:08 - 00970288 _____ () C:\Program Files (x86)\Playertools\VMware\VMware Workstation\libxml2.dll

2008-10-29 00:08 - 2008-10-29 00:08 - 00068656 _____ () C:\Program Files (x86)\Playertools\VMware\VMware Workstation\zlib1.dll

2014-07-27 15:55 - 2014-07-27 15:55 - 00043008 _____ () d:\benutzer\mariano\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpeehjtc.dll

2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\libcef.dll

2014-06-19 12:39 - 2014-06-06 20:40 - 00461120 _____ () D:\Benutzer\Mariano\Portable Anwendungen\PhraseExpress 10.1.57 Portable\pexlang.dll

2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2012-12-19 21:28 - 2012-04-11 20:06 - 01186816 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\TMSlite160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 00087552 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspropsaver160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 02478080 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vsvector160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 04680704 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfcore160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 02693120 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\BBlite160.bpl

2012-12-19 21:28 - 2012-02-23 16:11 - 00025088 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vstrees160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 00064512 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vsprinters160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 00064512 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfprinter160.bpl

2012-12-19 21:28 - 2011-09-30 19:10 - 00684032 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\js32.dll

2012-12-19 21:28 - 2012-04-11 20:06 - 00097280 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\expertpdfcore160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 02253824 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\PKIECtrl160.bpl

2012-12-19 21:28 - 2012-04-11 20:06 - 00517120 _____ () C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfeditor160.bpl

2014-04-04 01:54 - 2014-04-04 01:54 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\82f383a4d239eb434e37b408bec087f6\IsdiInterop.ni.dll

2011-11-19 12:33 - 2010-11-06 00:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\Windows\SysWOW64\zlib.dll:DocumentSummaryInformation

AlternateDataStreams: C:\Windows\SysWOW64\zlib.dll:SummaryInformation

AlternateDataStreams: C:\Windows\SysWOW64\zlib.dll:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DataIglooService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DFServ => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DataIglooService => ""="Service"
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

==================== Faulty Device Manager Devices =============
 

Name: 

Description: 

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

System errors:

=============
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Percentage of memory in use: 33%

Total physical RAM: 8086.17 MB

Available physical RAM: 5364.61 MB

Total Pagefile: 16170.52 MB

Available Pagefile: 13114.09 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: (Mano) (Fixed) (Total:97.65 GB) (Free:12.35 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (Mariano) (Fixed) (Total:600.88 GB) (Free:44.7 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 07F2837E)

Partition 1: (Not Active) - (Size=102 MB) - (Type=DE)

Partition 2: (Active) - (Size=98 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=601 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Kannst du damit schon was anfangen?

Beste Grüße
Mariano

Was ich jetzt in Eigenregie gemacht habe...
Ich habe Windows Updates auf den neuesten Stand gebracht und Java aktualisiert.

Hier das aktuelle FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014

Ran by Mariano (administrator) on MARIANO-LAPTOP on 27-07-2014 18:30:54

Running from D:\Benutzer\Mariano\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Faronics Corporation) C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DFServ.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(COMODO) C:\Program Files\Internettools\COMODO\COMODO Internet Security\cmdagent.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Microsoft Corporation) D:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Steganos Software GmbH) C:\Program Files (x86)\Steganos Online Shield\OnlineShieldService.exe

(Jedox AG) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo\palo.exe

(Apache Software Foundation) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\httpd.exe

(Jedox AG) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\palo\palo.exe

(Apache Software Foundation) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\tomcat\bin\paloTomcat6.exe

(QUALCOMM, Inc.) C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kDell.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Faronics Corporation) C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe

(Ericsson AB) C:\Program Files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(VMware, Inc.) C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-authd.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe

(Apache Software Foundation) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\httpd.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe

(COMODO) C:\Program Files\Internettools\COMODO\COMODO Internet Security\cfp.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(DT Soft Ltd) C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTAgent.exe

(Steganos Software GmbH) C:\Program Files (x86)\Steganos Online Shield\OnlineShieldClient.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Dell) D:\Benutzer\Mariano\AppData\Local\Apps\2.0\TLWZ2CG6.15O\62DQ7C9Q.K6T\dell..tion_0f612f649c4a10af_0005.0006_f9e15713f5aac8ac\DellSystemDetect.exe

(SoftBureau.com) C:\Program Files (x86)\CD Locker\CDLocker.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Apple Inc.) C:\Program Files (x86)\Playertools\iTunes\iTunesHelper.exe

(Visagesoft) C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfprsrv.exe

(VMware, Inc.) C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-tray.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() D:\Benutzer\Mariano\Portable Anwendungen\CLCL\CLCL.exe

(DT Soft Ltd) C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTShellHlp.exe

(Dropbox, Inc.) D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\Dropbox.exe

() D:\Benutzer\Mariano\Downloads\Easytoolz\EasyToolz.exe

(Bartels Media GmbH) D:\Benutzer\Mariano\Portable Anwendungen\PhraseExpress 10.1.57 Portable\phraseexpress.exe

(Microsoft Corporation) C:\Windows\splwow64.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6561384 2010-12-14] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2010-12-10] (Realtek Semiconductor)

HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [4479648 2011-01-25] (Dell Inc.)

HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\Internettools\COMODO\COMODO Internet Security\cfp.exe [9577680 2012-11-08] (COMODO)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2531624 2010-12-17] (Synaptics Incorporated)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" 

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart 

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\Playertools\iTunes\iTunesHelper.exe [421776 2012-09-10] (Apple Inc.)

HKLM-x32\...\Run: [vspdfprsrv.exe] => C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfprsrv.exe [6082560 2012-04-23] (Visagesoft)

HKLM-x32\...\Run: [vmware-tray] => C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-tray.exe [96816 2008-10-29] (VMware, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)

Winlogon\Notify\DfLogon: LogonDll.dll [X]

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTAgent.exe [4527424 2011-08-17] (DT Soft Ltd)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [CCWinTray] => C:\Windows\tray\wintmr.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [SOS_Agent] => C:\Program Files (x86)\Steganos Online Shield\OnlineShieldClient.exe [4493536 2013-05-16] (Steganos Software GmbH)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [Free CD/DVD Guard] => C:\Program Files (x86)\Free CD-DVD Guard\cddg.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [DellSystemDetect] => D:\Benutzer\Mariano\AppData\Local\Apps\2.0\TLWZ2CG6.15O\62DQ7C9Q.K6T\dell..tion_0f612f649c4a10af_000 (the data entry has 45 more characters).

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {6c175d68-4d4a-11e3-a6e9-005056c00008} - G:\.\Setup.exe AUTORUN=1

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {6c175d88-4d4a-11e3-a6e9-005056c00008} - G:\.\Setup.exe AUTORUN=1

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {b1b7974c-11d9-11e1-b387-806e6f6e6963} - F:\autoRcd.exe

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {ffe51fc2-b8a5-11e2-bba9-005056c00008} - G:\AutoRun.exe

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {ffe51fdf-b8a5-11e2-bba9-005056c00008} - G:\AutoRun.exe

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-05-20] (NVIDIA Corporation)

AppInit_DLLs:  C:\Windows\system32\guard64.dll => C:\Windows\system32\guard64.dll [390392 2012-11-08] (COMODO)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-05-20] (NVIDIA Corporation)

AppInit_DLLs-x32:  C:\Windows\SysWOW64\guard32.dll => C:\Windows\SysWOW64\guard32.dll [301264 2012-11-08] (COMODO)

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EasyToolz.lnk

ShortcutTarget: EasyToolz.lnk -> D:\Benutzer\Mariano\Downloads\Easytoolz\EasyToolz.exe ()

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk

ShortcutTarget: PhraseExpress.lnk -> D:\Benutzer\Mariano\Portable Anwendungen\PhraseExpress 10.1.57 Portable\phraseexpress.exe (Bartels Media GmbH)

ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

BootExecute: autocheck autochk /k:C /k:D * 
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com

URLSearchHook: HKCU - (No Name) - {422f7661-9403-4da4-b4ef-cc3e268817b5} - No File

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKCU - {0C0959A2-B193-4209-8431-E81BE6AE5205} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {6E7B2DC4-58AD-48AB-9351-176746EFEA87} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {86D6A1A3-AF61-4326-B4A4-085589A36AFD} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {A15D9866-E120-4E4D-A7AA-4E24ED726EFB} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {C7764045-5997-4A9C-A30C-866C6AF7A45F} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {E1EE7EFD-6157-4437-A45B-70D1F3E75749} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->  No File

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Perfect PDF 7 - {277BA090-1A90-4EDD-8F61-6574E274F50A} - C:\Program Files (x86)\Bearbeitungstools\Perfect PDF 7\ieagent64.dll (soft Xpansion)

Toolbar: HKLM-x32 - Perfect PDF 7 - {277BA090-1A90-4EDD-8F61-6574E274F50A} - C:\Program Files (x86)\Bearbeitungstools\Perfect PDF 7\ieagent32.dll (soft Xpansion)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default

FF Homepage: www.google.de

FF NetworkProxy: "backup.ftp", ""

FF NetworkProxy: "backup.ftp_port", 0

FF NetworkProxy: "backup.socks", ""

FF NetworkProxy: "backup.socks_port", 0

FF NetworkProxy: "backup.ssl", ""

FF NetworkProxy: "backup.ssl_port", 0

FF NetworkProxy: "ftp", "200.130.146.35"

FF NetworkProxy: "ftp_port", 80

FF NetworkProxy: "http", "200.130.146.35"

FF NetworkProxy: "http_port", 80

FF NetworkProxy: "share_proxy_settings", true

FF NetworkProxy: "socks", "200.130.146.35"

FF NetworkProxy: "socks_port", 80

FF NetworkProxy: "ssl", "200.130.146.35"

FF NetworkProxy: "ssl_port", 80

FF NetworkProxy: "type", 4

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\Playertools\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\BEARBE~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @soft-xpansion/npsxpdf - C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll (soft-Xpansion)

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{0911546D-894C-4426-8EA0-1F403CA32652}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{7F915D2E-7D07-4CF2-9B7E-B3E7D61CB861}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{81D5A205-FC3F-424B-9B01-509CD9A18B37}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{87245C8D-940D-4713-8A08-0E6E8B9E78E4}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{D4856139-5791-401C-AC00-CAF7B8984560}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{EEED5176-DC4F-4474-9F79-2C171AC02607}.xml

FF Extension: ProxTube - Unblock YouTube - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\ich@maltegoetz.de [2013-12-13]

FF Extension: Adblock Plus Pop-up Addon - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\adblockpopups@jessehakanen.net.xpi [2013-02-24]

FF Extension: Firebug - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\firebug@software.joehewitt.com.xpi [2012-04-23]

FF Extension: FlashGot - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2014-02-07]

FF Extension: CoolPreviews - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}.xpi [2013-02-24]

FF Extension: Adblock Plus - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-24]

FF Extension: Download Statusbar - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2012-01-19]

FF HKLM-x32\...\Firefox\Extensions: [{9C163D15-E392-44d7-BAF5-B8278E005611}] - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb

FF Extension: soft Xpansion Perfect PDF 7 - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb [2013-08-19]

FF HKLM-x32\...\Thunderbird\Extensions: [{9C163D15-E392-44d7-BAF5-B8278E005611}] - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb

FF HKCU\...\Firefox\Extensions: [{cc5a9034-5e34-43a4-ab29-98b939fa1a74}] - C:\Program Files (x86)\Show-Password\136.xpi

FF StartMenuInternet: FIREFOX.EXE - D:\Benutzer\Mariano\Portable Anwendungen\FirefoxPortable\App\Firefox\firefox.exe
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2356408 2014-06-19] (Microsoft Corporation)

R2 cmdAgent; C:\Program Files\Internettools\COMODO\COMODO Internet Security\cmdagent.exe [2828408 2012-11-08] (COMODO)

S3 DataIglooService; C:\Program Files (x86)\Bearbeitungstools\Faronics\Data Igloo Standard\DIService.exe [154384 2010-12-08] (Faronics Corporation)

R2 DFServ; C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DFServ.exe [1075200 2011-09-01] (Faronics Corporation) [File not signed]

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)

R2 MSSQLSERVER; d:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe [62218696 2012-06-29] (Microsoft Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] ()

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1618888 2014-04-30] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21009352 2014-04-30] (NVIDIA Corporation)

R2 Online Shield Starter Service; C:\Program Files (x86)\Steganos Online Shield\OnlineShieldService.exe [303368 2013-05-16] (Steganos Software GmbH)

R2 PaloServerService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo\palo.exe [11776 2011-08-04] (Jedox AG) [File not signed]

R2 PaloSuiteHttpdService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\httpd.exe [20549 2010-10-18] (Apache Software Foundation) [File not signed]

R2 PaloSuiteMolapService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\palo\palo.exe [11776 2011-08-04] (Jedox AG) [File not signed]

R2 PaloSuiteTomcatService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\tomcat\bin\paloTomcat6.exe [57344 2011-06-30] (Apache Software Foundation) [File not signed]

S2 PaloWebCoreService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\core3\core.exe [1944576 2011-07-25] (Jedox AG) [File not signed]

R2 QDLService2kDell; C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kDell.exe [331512 2010-06-25] (QUALCOMM, Inc.)

S4 SQLSERVERAGENT; d:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE [441288 2012-06-29] (Microsoft Corporation)

S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-08-19] (soft Xpansion)

S3 ufad-ws60; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-ufad.exe [191024 2008-10-02] (VMware, Inc.)

R2 VMAuthdService; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-authd.exe [113200 2008-10-29] (VMware, Inc.)

R2 WMCoreService; C:\Program Files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe [463912 2010-08-18] (Ericsson AB)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [584056 2012-11-08] (COMODO)

R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [38144 2012-11-08] (COMODO)

R0 DeepFrz; C:\Windows\System32\Drivers\DeepFrz.sys [234520 2011-09-01] (Faronics Corporation)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [271424 2011-11-19] (DT Soft Ltd)

R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37392 2010-05-20] (Paragon Software Group)

R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [94288 2012-11-08] (COMODO)

R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [301512 2014-05-20] (NVIDIA Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19744 2014-04-30] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

S4 RsFx0153; C:\Windows\System32\DRIVERS\RsFx0153.sys [321992 2012-06-29] (Microsoft Corporation)

R2 vstor2-ws60; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vstor2-ws60.sys [32816 2008-10-02] (VMware, Inc.)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-07-27 18:30 - 2014-07-27 18:30 - 00019192 _____ () D:\Benutzer\Mariano\Desktop\FRST.txt

2014-07-27 18:19 - 2014-07-27 18:19 - 00004686 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log

2014-07-27 18:19 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-07-27 18:19 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-07-27 17:44 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-07-27 17:44 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll

2014-07-27 17:44 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-07-27 17:44 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-07-27 17:44 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll

2014-07-27 17:44 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2014-07-27 17:44 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2014-07-27 17:44 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll

2014-07-27 17:44 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-07-27 17:43 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-07-27 17:43 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-07-27 17:43 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-07-27 17:43 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-07-27 17:43 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2014-07-27 17:43 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2014-07-27 17:43 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2014-07-27 17:43 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2014-07-27 17:43 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2014-07-27 17:43 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-07-27 17:43 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-07-27 17:43 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-07-27 17:42 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe

2014-07-27 17:42 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe

2014-07-27 17:42 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-07-27 17:42 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2014-07-27 17:42 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2014-07-27 17:42 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2014-07-27 17:42 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-07-27 17:42 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-07-27 17:42 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-07-27 17:42 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-07-27 17:42 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-07-27 17:42 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-07-27 17:42 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-07-27 17:42 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-07-27 17:42 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-07-27 17:42 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-07-27 17:42 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-07-27 17:42 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2014-07-27 17:42 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2014-07-27 17:42 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2014-07-27 17:42 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2014-07-27 17:42 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2014-07-27 17:42 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2014-07-27 17:42 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2014-07-27 17:42 - 2013-11-26 13:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-07-27 16:07 - 2014-07-27 18:30 - 00000000 ____D () C:\FRST

2014-07-27 15:58 - 2014-07-27 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-07-27 15:33 - 2014-07-27 15:49 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-27 15:33 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-07-27 15:33 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-07-27 15:33 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-07-27 15:30 - 2014-07-27 16:15 - 00000000 ____D () D:\Benutzer\Mariano\Desktop\Trojaner Log

2014-07-27 15:27 - 2014-07-27 16:33 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\Trojaner-Board

2014-07-27 15:18 - 2014-07-27 15:18 - 01029760 _____ () C:\Windows\Minidump\072714-17409-01.dmp

2014-07-27 15:01 - 2014-07-27 15:01 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\CrashDumps

2014-07-27 14:56 - 2014-07-27 15:03 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\NPE

2014-07-27 13:58 - 2014-07-27 13:58 - 02093568 _____ (Farbar) D:\Benutzer\Mariano\Desktop\FRST64.exe

2014-07-27 13:11 - 2014-07-27 13:11 - 05981830 _____ (Tim Kosse) D:\Benutzer\Mariano\Downloads\FileZilla_3.9.0.1_win32-setup.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-07-27 18:31 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-27 18:31 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-27 18:30 - 2014-07-27 18:30 - 00019192 _____ () D:\Benutzer\Mariano\Desktop\FRST.txt

2014-07-27 18:30 - 2014-07-27 16:07 - 00000000 ____D () C:\FRST

2014-07-27 18:24 - 2011-11-21 21:19 - 00000000 ___RD () D:\Benutzer\Mariano\Dropbox

2014-07-27 18:24 - 2011-11-19 14:11 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Roaming\Dropbox

2014-07-27 18:23 - 2013-12-31 01:26 - 00001576 _____ () D:\Benutzer\Mariano\AppData\Roaming\EasyToolz.ini

2014-07-27 18:22 - 2011-11-18 20:23 - 00215152 _____ () C:\Windows\DFError.log

2014-07-27 18:22 - 2009-07-14 06:51 - 00040643 _____ () C:\Windows\setupact.log

2014-07-27 18:21 - 2011-11-18 13:40 - 01722462 _____ () C:\Windows\WindowsUpdate.log

2014-07-27 18:21 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-27 18:19 - 2014-07-27 18:19 - 00004686 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log

2014-07-27 18:19 - 2012-03-31 12:07 - 00000000 ____D () C:\Program Files (x86)\Java

2014-07-27 18:08 - 2010-11-21 05:47 - 00175180 _____ () C:\Windows\PFRO.log

2014-07-27 18:08 - 2009-07-14 06:45 - 00439672 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-07-27 18:07 - 2010-11-21 09:17 - 00000000 ____D () C:\Program Files\Windows Journal

2014-07-27 18:06 - 2014-06-19 12:39 - 00000000 ____D () D:\Benutzer\Mariano\Documents\PhraseExpress

2014-07-27 18:02 - 2014-04-04 00:09 - 00000000 ____D () C:\Windows\system32\MRT

2014-07-27 18:00 - 2011-11-18 22:35 - 00765976 _____ () C:\Windows\system32\perfh007.dat

2014-07-27 18:00 - 2011-11-18 22:35 - 00174264 _____ () C:\Windows\system32\perfc007.dat

2014-07-27 18:00 - 2009-07-14 07:13 - 01829132 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-27 16:33 - 2014-07-27 15:27 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\Trojaner-Board

2014-07-27 16:24 - 2013-06-19 17:30 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-07-27 16:15 - 2014-07-27 15:30 - 00000000 ____D () D:\Benutzer\Mariano\Desktop\Trojaner Log

2014-07-27 15:58 - 2014-07-27 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-07-27 15:49 - 2014-07-27 15:33 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-27 15:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Branding

2014-07-27 15:33 - 2012-01-15 21:52 - 00000000 ____D () C:\Program Files (x86)\Systemtools

2014-07-27 15:18 - 2014-07-27 15:18 - 01029760 _____ () C:\Windows\Minidump\072714-17409-01.dmp

2014-07-27 15:18 - 2013-02-17 18:27 - 00000000 ____D () C:\Windows\Minidump

2014-07-27 15:15 - 2011-10-18 19:22 - 00000000 ____D () D:\Benutzer\Mariano\Portable Anwendungen

2014-07-27 15:03 - 2014-07-27 14:56 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\NPE

2014-07-27 15:01 - 2014-07-27 15:01 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\CrashDumps

2014-07-27 13:58 - 2014-07-27 13:58 - 02093568 _____ (Farbar) D:\Benutzer\Mariano\Desktop\FRST64.exe

2014-07-27 13:11 - 2014-07-27 13:11 - 05981830 _____ (Tim Kosse) D:\Benutzer\Mariano\Downloads\FileZilla_3.9.0.1_win32-setup.exe

2014-07-26 10:05 - 2011-11-19 14:11 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-07-20 22:34 - 2011-10-19 19:26 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\1-Click-Hoster

2014-07-11 03:02 - 2014-07-27 18:19 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-07-11 02:56 - 2014-07-27 18:19 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-07-11 02:56 - 2012-03-31 12:07 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-07-11 02:55 - 2012-03-31 12:07 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-07-05 11:57 - 2012-03-02 19:31 - 00002004 ____H () D:\Benutzer\Mariano\Documents\Default.rdp
 

Some content of TEMP:

====================

D:\Benutzer\Mariano\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpy6kzos.dll

D:\Benutzer\Mariano\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe

D:\Benutzer\Mariano\AppData\Local\Temp\nvSCPAPI.dll

D:\Benutzer\Mariano\AppData\Local\Temp\nvStInst.exe

D:\Benutzer\Mariano\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-04-04 02:16
 

==================== End Of Log ============================

--- --- ---

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hi und guten Abend,

hier die Logfiles...

Was mir und dir hier auffällt: Es ist 2x die Signatur "JS/Agent.NKW Trojaner" vorhanden.
Dies ist genau der Alarm, welcher mir von unserer Homepage zugeschickt wurde. Sprich reicht es den Facebook Slider einfach nur zu deaktivieren und als Komponente von Joomla zu löschen?
An der 2. Stelle im Profil des Firefoxes müsstest du mir wahrscheinlich helfen - wird wohl nicht reichen einfach nur diese Datei zu löschen oder?

EDIT:
Ich habe auf unserer Homepage den Facebook Slider deaktiviert und danach deinstalliert!

Eset Online Scanner:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=843d27bf896845419b45d452749640c7

# engine=19373

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-07-28 14:58:43

# local_time=2014-07-28 17:58:43 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='COMODO Antivirus'

# compatibility_mode=3074 16777213 100 100 36609120 96356803 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 35498 158142573 0 0

# scanned=670167

# found=12

# cleaned=0

# scan_time=20296

sh=D86451022DDD8348105C1D52FBFD2ADB1E2DCC30 ft=1 fh=d3e706a6307522ba vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="D:\AdwCleaner\Quarantine\D\Benutzer\Mariano\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll.vir"

sh=C4DCD5DF2EB287A3CB8A7E21CC558A6668F18BA9 ft=1 fh=3d0bba9b2704ddbf vn="Variante von Win32/Webprefix.B Trojaner" ac=I fn="D:\AdwCleaner\Quarantine\D\Benutzer\Mariano\AppData\Local\DownloadGuide\Offers\dprotect_setup.exe.vir"

sh=FED7CAA2E24771B66065C8D30131FC8037B6BD2A ft=1 fh=b41296876ed186e5 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="D:\AdwCleaner\Quarantine\D\Benutzer\Mariano\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"

sh=B6EFE9E9B30322C34E44340BB82BFA43D23DB893 ft=0 fh=0000000000000000 vn="JS/Agent.NKW Trojaner" ac=I fn="D:\Benutzer\Mariano\AppData\Local\Mozilla\Firefox\Profiles\tr6ttdee.default\Cache\C\C1\1B92Bd01"

sh=068A54F966DB6AC14BCA0E39E2A99E3F0027304D ft=1 fh=39f7a16b0423d981 vn="Win64/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\Benutzer\Mariano\AppData\LocalLow\RadioTotal1\hk64tbRadi.dll"

sh=CC6AF3A384A61C1C621BA5AB43583E82FF281530 ft=1 fh=bbbd034bf7d0bf76 vn="Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung" ac=I fn="D:\Benutzer\Mariano\AppData\LocalLow\RadioTotal1\hktbRadi.dll"

sh=9B3B44428CC80CC43F085AE514E7E16F7963EACC ft=1 fh=4c03fc1250fa29f9 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="D:\Benutzer\Mariano\AppData\LocalLow\RadioTotal1\ldrtbRadi.dll"

sh=33457E2F2405727124C107D6DEAF24C94E992463 ft=1 fh=e719e166edfd7994 vn="Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung" ac=I fn="D:\Benutzer\Mariano\AppData\LocalLow\RadioTotal1\tbRadi.dll"

sh=AB0B21BF19E28C5E4EFBD623FC64E1C9668BDBBC ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2012-1723.S Trojaner" ac=I fn="D:\Benutzer\Mariano\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\4f38d9aa-17f717ca"

sh=F3B8FA0053CCB1DDDCA36AAF2EF22FA6BF75A48F ft=1 fh=6fc455964d9c361a vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Benutzer\Mariano\Downloads\jd220435.exe"

sh=249ADF9740F0A002149855A15D93F70698E8A30F ft=1 fh=870f20eae3692438 vn="Win32/Packed.Autoit.C.Gen evtl. unerwünschte Anwendung" ac=I fn="D:\Benutzer\Mariano\Downloads\1-Click-Hoster\CRC-Killer.exe"

sh=9DBD595B2817308E97279A186FC2FF6CD8C70B49 ft=0 fh=0000000000000000 vn="JS/Agent.NKW Trojaner" ac=I fn="D:\Benutzer\Mariano\Downloads\1-Click-Hoster\Homepage\xampp 1.7.7 portable\xampp\htdocs\Joomla_Sportverein_Backup_Januar_2013\svs\modules\mod_FaceBookSlider\tmpl\default.php"

Security Check:

Code:

 Results of screen317's Security Check version 0.99.85  

 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 ``````````````Antivirus/Firewall Check:`````````````` 

 WMI entry may not exist for antivirus; attempting automatic update. 
 `````````Anti-malware/Other Utilities Check:````````` 

 Java(TM) 6 Update 31  

 Java 7 Update 65  

 Java version out of Date! 

  Adobe Flash Player 11.7.700.202 Flash Player out of Date!  
 ````````Process Check: objlist.exe by Laurent````````  

 Comodo Firewall cmdagent.exe 

 Steganos Online Shield OnlineShieldService.exe   

 Steganos Online Shield OnlineShieldClient.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

FRST:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014

Ran by Mariano (administrator) on MARIANO-LAPTOP on 28-07-2014 07:08:34

Running from D:\Benutzer\Mariano\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Faronics Corporation) C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DFServ.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(COMODO) C:\Program Files\Internettools\COMODO\COMODO Internet Security\cmdagent.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Microsoft Corporation) D:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Faronics Corporation) C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe

(DT Soft Ltd) C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTShellHlp.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Steganos Software GmbH) C:\Program Files (x86)\Steganos Online Shield\OnlineShieldService.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Jedox AG) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo\palo.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Steganos Software GmbH) C:\Program Files (x86)\Steganos Online Shield\OnlineShieldClient.exe

(Apache Software Foundation) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\httpd.exe

(Jedox AG) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\palo\palo.exe

(Apache Software Foundation) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\tomcat\bin\paloTomcat6.exe

(QUALCOMM, Inc.) C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kDell.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(Dell) D:\Benutzer\Mariano\AppData\Local\Apps\2.0\TLWZ2CG6.15O\62DQ7C9Q.K6T\dell..tion_0f612f649c4a10af_0005.0006_f9e15713f5aac8ac\DellSystemDetect.exe

(SoftBureau.com) C:\Program Files (x86)\CD Locker\CDLocker.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

() D:\Benutzer\Mariano\Portable Anwendungen\CLCL\CLCL.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Dropbox, Inc.) D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\Dropbox.exe

() D:\Benutzer\Mariano\Downloads\Easytoolz\EasyToolz.exe

(Bartels Media GmbH) D:\Benutzer\Mariano\Portable Anwendungen\PhraseExpress 10.1.57 Portable\phraseexpress.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Apple Inc.) C:\Program Files (x86)\Playertools\iTunes\iTunesHelper.exe

(Visagesoft) C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfprsrv.exe

(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe

(VMware, Inc.) C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-tray.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Ericsson AB) C:\Program Files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Jedox AG) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\core3\core.exe

(VMware, Inc.) C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-authd.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Corporation) C:\Windows\splwow64.exe

(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe

(Apache Software Foundation) C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\httpd.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6561384 2010-12-14] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2010-12-10] (Realtek Semiconductor)

HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [4479648 2011-01-25] (Dell Inc.)

HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\Internettools\COMODO\COMODO Internet Security\cfp.exe [9577680 2012-11-08] (COMODO)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2531624 2010-12-17] (Synaptics Incorporated)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" 

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart 

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\Playertools\iTunes\iTunesHelper.exe [421776 2012-09-10] (Apple Inc.)

HKLM-x32\...\Run: [vspdfprsrv.exe] => C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfprsrv.exe [6082560 2012-04-23] (Visagesoft)

HKLM-x32\...\Run: [vmware-tray] => C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-tray.exe [96816 2008-10-29] (VMware, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)

Winlogon\Notify\DfLogon: LogonDll.dll [X]

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTAgent.exe [4527424 2011-08-17] (DT Soft Ltd)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [CCWinTray] => C:\Windows\tray\wintmr.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [SOS_Agent] => C:\Program Files (x86)\Steganos Online Shield\OnlineShieldClient.exe [4493536 2013-05-16] (Steganos Software GmbH)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [Free CD/DVD Guard] => C:\Program Files (x86)\Free CD-DVD Guard\cddg.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [DellSystemDetect] => D:\Benutzer\Mariano\AppData\Local\Apps\2.0\TLWZ2CG6.15O\62DQ7C9Q.K6T\dell..tion_0f612f649c4a10af_000 (the data entry has 45 more characters).

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {6c175d68-4d4a-11e3-a6e9-005056c00008} - G:\.\Setup.exe AUTORUN=1

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {6c175d88-4d4a-11e3-a6e9-005056c00008} - G:\.\Setup.exe AUTORUN=1

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {b1b7974c-11d9-11e1-b387-806e6f6e6963} - F:\autoRcd.exe

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {ffe51fc2-b8a5-11e2-bba9-005056c00008} - G:\AutoRun.exe

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {ffe51fdf-b8a5-11e2-bba9-005056c00008} - G:\AutoRun.exe

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-05-20] (NVIDIA Corporation)

AppInit_DLLs:  C:\Windows\system32\guard64.dll => C:\Windows\system32\guard64.dll [390392 2012-11-08] (COMODO)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-05-20] (NVIDIA Corporation)

AppInit_DLLs-x32:  C:\Windows\SysWOW64\guard32.dll => C:\Windows\SysWOW64\guard32.dll [301264 2012-11-08] (COMODO)

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EasyToolz.lnk

ShortcutTarget: EasyToolz.lnk -> D:\Benutzer\Mariano\Downloads\Easytoolz\EasyToolz.exe ()

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk

ShortcutTarget: PhraseExpress.lnk -> D:\Benutzer\Mariano\Portable Anwendungen\PhraseExpress 10.1.57 Portable\phraseexpress.exe (Bartels Media GmbH)

ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

BootExecute: autocheck autochk /k:C /k:D * 
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com

URLSearchHook: HKCU - (No Name) - {422f7661-9403-4da4-b4ef-cc3e268817b5} - No File

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKCU - {0C0959A2-B193-4209-8431-E81BE6AE5205} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {6E7B2DC4-58AD-48AB-9351-176746EFEA87} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {86D6A1A3-AF61-4326-B4A4-085589A36AFD} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {A15D9866-E120-4E4D-A7AA-4E24ED726EFB} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {C7764045-5997-4A9C-A30C-866C6AF7A45F} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {E1EE7EFD-6157-4437-A45B-70D1F3E75749} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->  No File

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Perfect PDF 7 - {277BA090-1A90-4EDD-8F61-6574E274F50A} - C:\Program Files (x86)\Bearbeitungstools\Perfect PDF 7\ieagent64.dll (soft Xpansion)

Toolbar: HKLM-x32 - Perfect PDF 7 - {277BA090-1A90-4EDD-8F61-6574E274F50A} - C:\Program Files (x86)\Bearbeitungstools\Perfect PDF 7\ieagent32.dll (soft Xpansion)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default

FF Homepage: www.google.de

FF NetworkProxy: "backup.ftp", ""

FF NetworkProxy: "backup.ftp_port", 0

FF NetworkProxy: "backup.socks", ""

FF NetworkProxy: "backup.socks_port", 0

FF NetworkProxy: "backup.ssl", ""

FF NetworkProxy: "backup.ssl_port", 0

FF NetworkProxy: "ftp", "200.130.146.35"

FF NetworkProxy: "ftp_port", 80

FF NetworkProxy: "http", "200.130.146.35"

FF NetworkProxy: "http_port", 80

FF NetworkProxy: "share_proxy_settings", true

FF NetworkProxy: "socks", "200.130.146.35"

FF NetworkProxy: "socks_port", 80

FF NetworkProxy: "ssl", "200.130.146.35"

FF NetworkProxy: "ssl_port", 80

FF NetworkProxy: "type", 4

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\Playertools\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\BEARBE~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @soft-xpansion/npsxpdf - C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll (soft-Xpansion)

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{0911546D-894C-4426-8EA0-1F403CA32652}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{7F915D2E-7D07-4CF2-9B7E-B3E7D61CB861}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{81D5A205-FC3F-424B-9B01-509CD9A18B37}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{87245C8D-940D-4713-8A08-0E6E8B9E78E4}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{D4856139-5791-401C-AC00-CAF7B8984560}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{EEED5176-DC4F-4474-9F79-2C171AC02607}.xml

FF Extension: ProxTube - Unblock YouTube - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\ich@maltegoetz.de [2013-12-13]

FF Extension: Adblock Plus Pop-up Addon - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\adblockpopups@jessehakanen.net.xpi [2013-02-24]

FF Extension: Firebug - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\firebug@software.joehewitt.com.xpi [2012-04-23]

FF Extension: FlashGot - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2014-02-07]

FF Extension: CoolPreviews - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}.xpi [2013-02-24]

FF Extension: Adblock Plus - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-24]

FF Extension: Download Statusbar - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2012-01-19]

FF HKLM-x32\...\Firefox\Extensions: [{9C163D15-E392-44d7-BAF5-B8278E005611}] - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb

FF Extension: soft Xpansion Perfect PDF 7 - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb [2013-08-19]

FF HKLM-x32\...\Thunderbird\Extensions: [{9C163D15-E392-44d7-BAF5-B8278E005611}] - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb

FF HKCU\...\Firefox\Extensions: [{cc5a9034-5e34-43a4-ab29-98b939fa1a74}] - C:\Program Files (x86)\Show-Password\136.xpi

FF StartMenuInternet: FIREFOX.EXE - D:\Benutzer\Mariano\Portable Anwendungen\FirefoxPortable\App\Firefox\firefox.exe
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2356408 2014-06-19] (Microsoft Corporation)

R2 cmdAgent; C:\Program Files\Internettools\COMODO\COMODO Internet Security\cmdagent.exe [2828408 2012-11-08] (COMODO)

S3 DataIglooService; C:\Program Files (x86)\Bearbeitungstools\Faronics\Data Igloo Standard\DIService.exe [154384 2010-12-08] (Faronics Corporation)

R2 DFServ; C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DFServ.exe [1075200 2011-09-01] (Faronics Corporation) [File not signed]

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)

R2 MSSQLSERVER; d:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe [62218696 2012-06-29] (Microsoft Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] ()

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1618888 2014-04-30] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21009352 2014-04-30] (NVIDIA Corporation)

R2 Online Shield Starter Service; C:\Program Files (x86)\Steganos Online Shield\OnlineShieldService.exe [303368 2013-05-16] (Steganos Software GmbH)

R2 PaloServerService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo\palo.exe [11776 2011-08-04] (Jedox AG) [File not signed]

R2 PaloSuiteHttpdService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\httpd.exe [20549 2010-10-18] (Apache Software Foundation) [File not signed]

R2 PaloSuiteMolapService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\palo\palo.exe [11776 2011-08-04] (Jedox AG) [File not signed]

R2 PaloSuiteTomcatService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\tomcat\bin\paloTomcat6.exe [57344 2011-06-30] (Apache Software Foundation) [File not signed]

R2 PaloWebCoreService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\core3\core.exe [1944576 2011-07-25] (Jedox AG) [File not signed]

R2 QDLService2kDell; C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kDell.exe [331512 2010-06-25] (QUALCOMM, Inc.)

S4 SQLSERVERAGENT; d:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE [441288 2012-06-29] (Microsoft Corporation)

S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-08-19] (soft Xpansion)

S3 ufad-ws60; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-ufad.exe [191024 2008-10-02] (VMware, Inc.)

R2 VMAuthdService; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-authd.exe [113200 2008-10-29] (VMware, Inc.)

R2 WMCoreService; C:\Program Files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe [463912 2010-08-18] (Ericsson AB)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [584056 2012-11-08] (COMODO)

R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [38144 2012-11-08] (COMODO)

R0 DeepFrz; C:\Windows\System32\Drivers\DeepFrz.sys [234520 2011-09-01] (Faronics Corporation)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [271424 2011-11-19] (DT Soft Ltd)

R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37392 2010-05-20] (Paragon Software Group)

R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [94288 2012-11-08] (COMODO)

R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [301512 2014-05-20] (NVIDIA Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19744 2014-04-30] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

S4 RsFx0153; C:\Windows\System32\DRIVERS\RsFx0153.sys [321992 2012-06-29] (Microsoft Corporation)

R2 vstor2-ws60; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vstor2-ws60.sys [32816 2008-10-02] (VMware, Inc.)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-07-28 07:08 - 2014-07-28 07:08 - 00019254 _____ () D:\Benutzer\Mariano\Desktop\FRST.txt

2014-07-27 22:02 - 2014-07-27 22:02 - 00854390 _____ () D:\Benutzer\Mariano\Desktop\SecurityCheck.exe

2014-07-27 22:01 - 2014-07-27 22:02 - 02347384 _____ (ESET) D:\Benutzer\Mariano\Desktop\esetsmartinstaller_deu.exe

2014-07-27 18:19 - 2014-07-27 18:19 - 00004686 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log

2014-07-27 18:19 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-07-27 18:19 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-07-27 17:44 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-07-27 17:44 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll

2014-07-27 17:44 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-07-27 17:44 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-07-27 17:44 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll

2014-07-27 17:44 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2014-07-27 17:44 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2014-07-27 17:44 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll

2014-07-27 17:44 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-07-27 17:43 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-07-27 17:43 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-07-27 17:43 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-07-27 17:43 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-07-27 17:43 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2014-07-27 17:43 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2014-07-27 17:43 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2014-07-27 17:43 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2014-07-27 17:43 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2014-07-27 17:43 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-07-27 17:43 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-07-27 17:43 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-07-27 17:42 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe

2014-07-27 17:42 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe

2014-07-27 17:42 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-07-27 17:42 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2014-07-27 17:42 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2014-07-27 17:42 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2014-07-27 17:42 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-07-27 17:42 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-07-27 17:42 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-07-27 17:42 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-07-27 17:42 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-07-27 17:42 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-07-27 17:42 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-07-27 17:42 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-07-27 17:42 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-07-27 17:42 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-07-27 17:42 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-07-27 17:42 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2014-07-27 17:42 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2014-07-27 17:42 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2014-07-27 17:42 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2014-07-27 17:42 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2014-07-27 17:42 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2014-07-27 17:42 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2014-07-27 17:42 - 2013-11-26 13:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-07-27 16:07 - 2014-07-28 07:08 - 00000000 ____D () C:\FRST

2014-07-27 15:58 - 2014-07-27 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-07-27 15:33 - 2014-07-27 15:49 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-27 15:33 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-07-27 15:33 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-07-27 15:33 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-07-27 15:30 - 2014-07-27 16:15 - 00000000 ____D () D:\Benutzer\Mariano\Desktop\Trojaner Log

2014-07-27 15:27 - 2014-07-28 07:08 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\Trojaner-Board

2014-07-27 15:18 - 2014-07-27 15:18 - 01029760 _____ () C:\Windows\Minidump\072714-17409-01.dmp

2014-07-27 15:01 - 2014-07-27 15:01 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\CrashDumps

2014-07-27 14:56 - 2014-07-27 15:03 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\NPE

2014-07-27 13:58 - 2014-07-27 13:58 - 02093568 _____ (Farbar) D:\Benutzer\Mariano\Desktop\FRST64.exe

2014-07-27 13:11 - 2014-07-27 13:11 - 05981830 _____ (Tim Kosse) D:\Benutzer\Mariano\Downloads\FileZilla_3.9.0.1_win32-setup.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-07-28 07:08 - 2014-07-28 07:08 - 00019254 _____ () D:\Benutzer\Mariano\Desktop\FRST.txt

2014-07-28 07:08 - 2014-07-27 16:07 - 00000000 ____D () C:\FRST

2014-07-28 07:08 - 2014-07-27 15:27 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\Trojaner-Board

2014-07-28 01:07 - 2011-11-18 20:23 - 00216207 _____ () C:\Windows\DFError.log

2014-07-27 22:13 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-27 22:13 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-27 22:09 - 2011-11-18 13:40 - 01726199 _____ () C:\Windows\WindowsUpdate.log

2014-07-27 22:06 - 2011-11-21 21:19 - 00000000 ___RD () D:\Benutzer\Mariano\Dropbox

2014-07-27 22:06 - 2011-11-19 14:11 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Roaming\Dropbox

2014-07-27 22:04 - 2013-12-31 01:26 - 00001576 _____ () D:\Benutzer\Mariano\AppData\Roaming\EasyToolz.ini

2014-07-27 22:04 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-27 22:04 - 2009-07-14 06:51 - 00040811 _____ () C:\Windows\setupact.log

2014-07-27 22:03 - 2014-06-19 12:39 - 00000000 ____D () D:\Benutzer\Mariano\Documents\PhraseExpress

2014-07-27 22:02 - 2014-07-27 22:02 - 00854390 _____ () D:\Benutzer\Mariano\Desktop\SecurityCheck.exe

2014-07-27 22:02 - 2014-07-27 22:01 - 02347384 _____ (ESET) D:\Benutzer\Mariano\Desktop\esetsmartinstaller_deu.exe

2014-07-27 18:19 - 2014-07-27 18:19 - 00004686 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log

2014-07-27 18:19 - 2012-03-31 12:07 - 00000000 ____D () C:\Program Files (x86)\Java

2014-07-27 18:08 - 2010-11-21 05:47 - 00175180 _____ () C:\Windows\PFRO.log

2014-07-27 18:08 - 2009-07-14 06:45 - 00439672 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-07-27 18:07 - 2010-11-21 09:17 - 00000000 ____D () C:\Program Files\Windows Journal

2014-07-27 18:03 - 2014-04-04 00:09 - 00000000 ____D () C:\Windows\system32\MRT

2014-07-27 18:00 - 2011-11-18 22:35 - 00765976 _____ () C:\Windows\system32\perfh007.dat

2014-07-27 18:00 - 2011-11-18 22:35 - 00174264 _____ () C:\Windows\system32\perfc007.dat

2014-07-27 18:00 - 2009-07-14 07:13 - 01829132 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-27 16:24 - 2013-06-19 17:30 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-07-27 16:15 - 2014-07-27 15:30 - 00000000 ____D () D:\Benutzer\Mariano\Desktop\Trojaner Log

2014-07-27 15:58 - 2014-07-27 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-07-27 15:49 - 2014-07-27 15:33 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-27 15:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Branding

2014-07-27 15:33 - 2012-01-15 21:52 - 00000000 ____D () C:\Program Files (x86)\Systemtools

2014-07-27 15:18 - 2014-07-27 15:18 - 01029760 _____ () C:\Windows\Minidump\072714-17409-01.dmp

2014-07-27 15:18 - 2013-02-17 18:27 - 00000000 ____D () C:\Windows\Minidump

2014-07-27 15:15 - 2011-10-18 19:22 - 00000000 ____D () D:\Benutzer\Mariano\Portable Anwendungen

2014-07-27 15:03 - 2014-07-27 14:56 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\NPE

2014-07-27 15:01 - 2014-07-27 15:01 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\CrashDumps

2014-07-27 13:58 - 2014-07-27 13:58 - 02093568 _____ (Farbar) D:\Benutzer\Mariano\Desktop\FRST64.exe

2014-07-27 13:11 - 2014-07-27 13:11 - 05981830 _____ (Tim Kosse) D:\Benutzer\Mariano\Downloads\FileZilla_3.9.0.1_win32-setup.exe

2014-07-26 10:05 - 2011-11-19 14:11 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-07-20 22:34 - 2011-10-19 19:26 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\1-Click-Hoster

2014-07-11 03:02 - 2014-07-27 18:19 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-07-11 02:56 - 2014-07-27 18:19 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-07-11 02:56 - 2012-03-31 12:07 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-07-11 02:55 - 2012-03-31 12:07 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-07-05 11:57 - 2012-03-02 19:31 - 00002004 ____H () D:\Benutzer\Mariano\Documents\Default.rdp
 

Some content of TEMP:

====================

D:\Benutzer\Mariano\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpg4c0cn.dll

D:\Benutzer\Mariano\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe

D:\Benutzer\Mariano\AppData\Local\Temp\nvSCPAPI.dll

D:\Benutzer\Mariano\AppData\Local\Temp\nvStInst.exe

D:\Benutzer\Mariano\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-04-04 02:16
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Danke dir und Grüße
Mariano

Neues RFST Log:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014

Ran by Mariano (administrator) on MARIANO-LAPTOP on 28-07-2014 18:13:40

Running from D:\Benutzer\Mariano\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Faronics Corporation) C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe

(COMODO) C:\Program Files\Internettools\COMODO\COMODO Internet Security\cfp.exe

(DT Soft Ltd) C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTShellHlp.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(DT Soft Ltd) C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTAgent.exe

(Steganos Software GmbH) C:\Program Files (x86)\Steganos Online Shield\OnlineShieldClient.exe

(Dell) D:\Benutzer\Mariano\AppData\Local\Apps\2.0\TLWZ2CG6.15O\62DQ7C9Q.K6T\dell..tion_0f612f649c4a10af_0005.0006_f9e15713f5aac8ac\DellSystemDetect.exe

(SoftBureau.com) C:\Program Files (x86)\CD Locker\CDLocker.exe

() D:\Benutzer\Mariano\Portable Anwendungen\CLCL\CLCL.exe

(Dropbox, Inc.) D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\Dropbox.exe

() D:\Benutzer\Mariano\Downloads\Easytoolz\EasyToolz.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Bartels Media GmbH) D:\Benutzer\Mariano\Portable Anwendungen\PhraseExpress 10.1.57 Portable\phraseexpress.exe

(Apple Inc.) C:\Program Files (x86)\Playertools\iTunes\iTunesHelper.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Visagesoft) C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfprsrv.exe

(VMware, Inc.) C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-tray.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Microsoft Corporation) C:\Windows\splwow64.exe

(Mozilla Corporation) D:\Benutzer\Mariano\Portable Anwendungen\ThunderbirdPortable\App\Thunderbird\thunderbird.exe

(Mozilla Corporation) D:\Benutzer\Mariano\Portable Anwendungen\FirefoxPortable\App\Firefox\firefox.exe

(Sun Microsystems, Inc.) D:\Benutzer\Mariano\Portable Anwendungen\JDownloaderPortable\CommonFiles\Java\bin\javaw.exe

(PortableApps.com) D:\Benutzer\Mariano\Portable Anwendungen\FileZillaPortable\FileZillaPortable.exe

(FileZilla Project) D:\Benutzer\Mariano\Portable Anwendungen\FileZillaPortable\App\filezilla\filezilla.exe

() D:\Benutzer\Mariano\Portable Anwendungen\Scribble Papers\ScPapers.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6561384 2010-12-14] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2010-12-10] (Realtek Semiconductor)

HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [4479648 2011-01-25] (Dell Inc.)

HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\Internettools\COMODO\COMODO Internet Security\cfp.exe [9577680 2012-11-08] (COMODO)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2531624 2010-12-17] (Synaptics Incorporated)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" 

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart 

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\Playertools\iTunes\iTunesHelper.exe [421776 2012-09-10] (Apple Inc.)

HKLM-x32\...\Run: [vspdfprsrv.exe] => C:\Program Files (x86)\Bearbeitungstools\Avanquest\PDF Experte 8 Ultimate\vspdfprsrv.exe [6082560 2012-04-23] (Visagesoft)

HKLM-x32\...\Run: [vmware-tray] => C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-tray.exe [96816 2008-10-29] (VMware, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)

Winlogon\Notify\DfLogon: LogonDll.dll [X]

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files (x86)\Bearbeitungstools\DAEMON Tools Pro\DTAgent.exe [4527424 2011-08-17] (DT Soft Ltd)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [CCWinTray] => C:\Windows\tray\wintmr.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [SOS_Agent] => C:\Program Files (x86)\Steganos Online Shield\OnlineShieldClient.exe [4493536 2013-05-16] (Steganos Software GmbH)

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [Free CD/DVD Guard] => C:\Program Files (x86)\Free CD-DVD Guard\cddg.exe 

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\Run: [DellSystemDetect] => D:\Benutzer\Mariano\AppData\Local\Apps\2.0\TLWZ2CG6.15O\62DQ7C9Q.K6T\dell..tion_0f612f649c4a10af_000 (the data entry has 45 more characters).

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {6c175d68-4d4a-11e3-a6e9-005056c00008} - G:\.\Setup.exe AUTORUN=1

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {6c175d88-4d4a-11e3-a6e9-005056c00008} - G:\.\Setup.exe AUTORUN=1

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {b1b7974c-11d9-11e1-b387-806e6f6e6963} - F:\autoRcd.exe

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {ffe51fc2-b8a5-11e2-bba9-005056c00008} - G:\AutoRun.exe

HKU\S-1-5-21-4278949540-2208170464-1142639898-1000\...\MountPoints2: {ffe51fdf-b8a5-11e2-bba9-005056c00008} - G:\AutoRun.exe

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-05-20] (NVIDIA Corporation)

AppInit_DLLs:  C:\Windows\system32\guard64.dll => C:\Windows\system32\guard64.dll [390392 2012-11-08] (COMODO)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-05-20] (NVIDIA Corporation)

AppInit_DLLs-x32:  C:\Windows\SysWOW64\guard32.dll => C:\Windows\SysWOW64\guard32.dll [301264 2012-11-08] (COMODO)

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EasyToolz.lnk

ShortcutTarget: EasyToolz.lnk -> D:\Benutzer\Mariano\Downloads\Easytoolz\EasyToolz.exe ()

Startup: D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk

ShortcutTarget: PhraseExpress.lnk -> D:\Benutzer\Mariano\Portable Anwendungen\PhraseExpress 10.1.57 Portable\phraseexpress.exe (Bartels Media GmbH)

ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => D:\Benutzer\Mariano\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

BootExecute: autocheck autochk /k:C /k:D * 
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com

URLSearchHook: HKCU - (No Name) - {422f7661-9403-4da4-b4ef-cc3e268817b5} - No File

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKCU - {0C0959A2-B193-4209-8431-E81BE6AE5205} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {6E7B2DC4-58AD-48AB-9351-176746EFEA87} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {86D6A1A3-AF61-4326-B4A4-085589A36AFD} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {A15D9866-E120-4E4D-A7AA-4E24ED726EFB} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {C7764045-5997-4A9C-A30C-866C6AF7A45F} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

SearchScopes: HKCU - {E1EE7EFD-6157-4437-A45B-70D1F3E75749} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=9a34a892-af84-44fa-84a1-858f67e8b13e&pid=freewarede&mode=bounce&k=0

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->  No File

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Perfect PDF 7 - {277BA090-1A90-4EDD-8F61-6574E274F50A} - C:\Program Files (x86)\Bearbeitungstools\Perfect PDF 7\ieagent64.dll (soft Xpansion)

Toolbar: HKLM-x32 - Perfect PDF 7 - {277BA090-1A90-4EDD-8F61-6574E274F50A} - C:\Program Files (x86)\Bearbeitungstools\Perfect PDF 7\ieagent32.dll (soft Xpansion)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default

FF Homepage: www.google.de

FF NetworkProxy: "backup.ftp", ""

FF NetworkProxy: "backup.ftp_port", 0

FF NetworkProxy: "backup.socks", ""

FF NetworkProxy: "backup.socks_port", 0

FF NetworkProxy: "backup.ssl", ""

FF NetworkProxy: "backup.ssl_port", 0

FF NetworkProxy: "ftp", "200.130.146.35"

FF NetworkProxy: "ftp_port", 80

FF NetworkProxy: "http", "200.130.146.35"

FF NetworkProxy: "http_port", 80

FF NetworkProxy: "share_proxy_settings", true

FF NetworkProxy: "socks", "200.130.146.35"

FF NetworkProxy: "socks_port", 80

FF NetworkProxy: "ssl", "200.130.146.35"

FF NetworkProxy: "ssl_port", 80

FF NetworkProxy: "type", 4

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\Playertools\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\BEARBE~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @soft-xpansion/npsxpdf - C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll (soft-Xpansion)

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{0911546D-894C-4426-8EA0-1F403CA32652}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{7F915D2E-7D07-4CF2-9B7E-B3E7D61CB861}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{81D5A205-FC3F-424B-9B01-509CD9A18B37}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{87245C8D-940D-4713-8A08-0E6E8B9E78E4}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{D4856139-5791-401C-AC00-CAF7B8984560}.xml

FF SearchPlugin: D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\searchplugins\{EEED5176-DC4F-4474-9F79-2C171AC02607}.xml

FF Extension: ProxTube - Unblock YouTube - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\ich@maltegoetz.de [2013-12-13]

FF Extension: Adblock Plus Pop-up Addon - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\adblockpopups@jessehakanen.net.xpi [2013-02-24]

FF Extension: Firebug - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\firebug@software.joehewitt.com.xpi [2012-04-23]

FF Extension: FlashGot - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2014-02-07]

FF Extension: CoolPreviews - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}.xpi [2013-02-24]

FF Extension: Adblock Plus - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-24]

FF Extension: Download Statusbar - D:\Benutzer\Mariano\AppData\Roaming\Mozilla\Firefox\Profiles\tr6ttdee.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2012-01-19]

FF HKLM-x32\...\Firefox\Extensions: [{9C163D15-E392-44d7-BAF5-B8278E005611}] - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb

FF Extension: soft Xpansion Perfect PDF 7 - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb [2013-08-19]

FF HKLM-x32\...\Thunderbird\Extensions: [{9C163D15-E392-44d7-BAF5-B8278E005611}] - C:\ProgramData\soft Xpansion\Perfect PDF 7\Data\fftb

FF HKCU\...\Firefox\Extensions: [{cc5a9034-5e34-43a4-ab29-98b939fa1a74}] - C:\Program Files (x86)\Show-Password\136.xpi

FF StartMenuInternet: FIREFOX.EXE - D:\Benutzer\Mariano\Portable Anwendungen\FirefoxPortable\App\Firefox\firefox.exe
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2356408 2014-06-19] (Microsoft Corporation)

R2 cmdAgent; C:\Program Files\Internettools\COMODO\COMODO Internet Security\cmdagent.exe [2828408 2012-11-08] (COMODO)

S3 DataIglooService; C:\Program Files (x86)\Bearbeitungstools\Faronics\Data Igloo Standard\DIService.exe [154384 2010-12-08] (Faronics Corporation)

R2 DFServ; C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DFServ.exe [1075200 2011-09-01] (Faronics Corporation) [File not signed]

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Bearbeitungstools\Microsoft Office\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)

R2 MSSQLSERVER; d:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe [62218696 2012-06-29] (Microsoft Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] ()

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1618888 2014-04-30] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21009352 2014-04-30] (NVIDIA Corporation)

R2 Online Shield Starter Service; C:\Program Files (x86)\Steganos Online Shield\OnlineShieldService.exe [303368 2013-05-16] (Steganos Software GmbH)

R2 PaloServerService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo\palo.exe [11776 2011-08-04] (Jedox AG) [File not signed]

R2 PaloSuiteHttpdService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\httpd\httpd.exe [20549 2010-10-18] (Apache Software Foundation) [File not signed]

R2 PaloSuiteMolapService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\palo\palo.exe [11776 2011-08-04] (Jedox AG) [File not signed]

R2 PaloSuiteTomcatService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\tomcat\bin\paloTomcat6.exe [57344 2011-06-30] (Apache Software Foundation) [File not signed]

R2 PaloWebCoreService; C:\Program Files (x86)\Bearbeitungstools\Jedox\Palo Suite\core3\core.exe [1944576 2011-07-25] (Jedox AG) [File not signed]

R2 QDLService2kDell; C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kDell.exe [331512 2010-06-25] (QUALCOMM, Inc.)

S4 SQLSERVERAGENT; d:\Benutzer\Mariano\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE [441288 2012-06-29] (Microsoft Corporation)

S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-08-19] (soft Xpansion)

S3 ufad-ws60; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-ufad.exe [191024 2008-10-02] (VMware, Inc.)

R2 VMAuthdService; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vmware-authd.exe [113200 2008-10-29] (VMware, Inc.)

R2 WMCoreService; C:\Program Files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe [463912 2010-08-18] (Ericsson AB)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [584056 2012-11-08] (COMODO)

R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [38144 2012-11-08] (COMODO)

R0 DeepFrz; C:\Windows\System32\Drivers\DeepFrz.sys [234520 2011-09-01] (Faronics Corporation)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [271424 2011-11-19] (DT Soft Ltd)

R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37392 2010-05-20] (Paragon Software Group)

R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [94288 2012-11-08] (COMODO)

R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [301512 2014-05-20] (NVIDIA Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19744 2014-04-30] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

S4 RsFx0153; C:\Windows\System32\DRIVERS\RsFx0153.sys [321992 2012-06-29] (Microsoft Corporation)

R2 vstor2-ws60; C:\Program Files (x86)\Playertools\VMware\VMware Workstation\vstor2-ws60.sys [32816 2008-10-02] (VMware, Inc.)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-07-28 18:13 - 2014-07-28 18:13 - 00017262 _____ () D:\Benutzer\Mariano\Desktop\FRST.txt

2014-07-27 18:19 - 2014-07-27 18:19 - 00004686 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log

2014-07-27 18:19 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-07-27 18:19 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-07-27 17:44 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-07-27 17:44 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll

2014-07-27 17:44 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-07-27 17:44 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-07-27 17:44 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll

2014-07-27 17:44 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll

2014-07-27 17:44 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2014-07-27 17:44 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2014-07-27 17:44 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll

2014-07-27 17:44 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll

2014-07-27 17:44 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-07-27 17:43 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-07-27 17:43 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-07-27 17:43 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-07-27 17:43 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-07-27 17:43 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2014-07-27 17:43 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2014-07-27 17:43 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2014-07-27 17:43 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2014-07-27 17:43 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2014-07-27 17:43 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-07-27 17:43 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-07-27 17:43 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-07-27 17:43 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-07-27 17:43 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-07-27 17:42 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe

2014-07-27 17:42 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe

2014-07-27 17:42 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-07-27 17:42 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2014-07-27 17:42 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2014-07-27 17:42 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2014-07-27 17:42 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-07-27 17:42 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-07-27 17:42 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-07-27 17:42 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-07-27 17:42 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-07-27 17:42 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-07-27 17:42 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-07-27 17:42 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-07-27 17:42 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-07-27 17:42 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-07-27 17:42 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-07-27 17:42 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2014-07-27 17:42 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2014-07-27 17:42 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2014-07-27 17:42 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2014-07-27 17:42 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2014-07-27 17:42 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2014-07-27 17:42 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2014-07-27 17:42 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2014-07-27 17:42 - 2013-11-26 13:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-07-27 16:07 - 2014-07-28 18:13 - 00000000 ____D () C:\FRST

2014-07-27 15:58 - 2014-07-27 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-07-27 15:33 - 2014-07-27 15:49 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-27 15:33 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-07-27 15:33 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-07-27 15:33 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-07-27 15:27 - 2014-07-28 08:03 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\Trojaner-Board

2014-07-27 15:18 - 2014-07-27 15:18 - 01029760 _____ () C:\Windows\Minidump\072714-17409-01.dmp

2014-07-27 15:01 - 2014-07-27 15:01 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\CrashDumps

2014-07-27 14:56 - 2014-07-27 15:03 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\NPE

2014-07-27 13:58 - 2014-07-27 13:58 - 02093568 _____ (Farbar) D:\Benutzer\Mariano\Desktop\FRST64.exe

2014-07-27 13:11 - 2014-07-27 13:11 - 05981830 _____ (Tim Kosse) D:\Benutzer\Mariano\Downloads\FileZilla_3.9.0.1_win32-setup.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-07-28 18:13 - 2014-07-28 18:13 - 00017262 _____ () D:\Benutzer\Mariano\Desktop\FRST.txt

2014-07-28 18:13 - 2014-07-27 16:07 - 00000000 ____D () C:\FRST

2014-07-28 18:13 - 2011-10-19 19:23 - 00000000 ____D () D:\Benutzer\Mariano\Downloads

2014-07-28 17:06 - 2011-10-19 19:26 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\1

2014-07-28 13:17 - 2011-11-18 20:30 - 00000000 ____D () D:\Benutzer\Mariano

2014-07-28 10:51 - 2011-11-18 20:23 - 00217583 _____ () C:\Windows\DFError.log

2014-07-28 08:15 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-28 08:15 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-28 08:09 - 2011-11-21 21:19 - 00000000 ___RD () D:\Benutzer\Mariano\Dropbox

2014-07-28 08:08 - 2011-11-19 14:11 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Roaming\Dropbox

2014-07-28 08:07 - 2013-12-31 01:26 - 00001576 _____ () D:\Benutzer\Mariano\AppData\Roaming\EasyToolz.ini

2014-07-28 08:07 - 2011-11-18 20:19 - 16336688 _____ () C:\Persi0.sys

2014-07-28 08:07 - 2009-07-14 06:51 - 00040979 _____ () C:\Windows\setupact.log

2014-07-28 08:06 - 2010-11-21 05:47 - 00175998 _____ () C:\Windows\PFRO.log

2014-07-28 08:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-28 08:05 - 2014-06-19 12:39 - 00000000 ____D () D:\Benutzer\Mariano\Documents\PhraseExpress

2014-07-28 08:05 - 2011-11-18 13:40 - 01731736 _____ () C:\Windows\WindowsUpdate.log

2014-07-28 08:03 - 2014-07-27 15:27 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\Trojaner-Board

2014-07-28 07:23 - 2011-10-20 19:23 - 00000000 ____D () D:\Benutzer\Mariano\Downloads\Firewall

2014-07-27 18:19 - 2014-07-27 18:19 - 00004686 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log

2014-07-27 18:19 - 2012-03-31 12:07 - 00000000 ____D () C:\Program Files (x86)\Java

2014-07-27 18:08 - 2009-07-14 06:45 - 00439672 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-07-27 18:07 - 2010-11-21 09:17 - 00000000 ____D () C:\Program Files\Windows Journal

2014-07-27 18:03 - 2014-04-04 00:09 - 00000000 ____D () C:\Windows\system32\MRT

2014-07-27 18:00 - 2011-11-18 22:35 - 00765976 _____ () C:\Windows\system32\perfh007.dat

2014-07-27 18:00 - 2011-11-18 22:35 - 00174264 _____ () C:\Windows\system32\perfc007.dat

2014-07-27 18:00 - 2009-07-14 07:13 - 01829132 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-27 16:24 - 2013-06-19 17:30 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-07-27 15:58 - 2014-07-27 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-07-27 15:49 - 2014-07-27 15:33 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-27 15:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Branding

2014-07-27 15:33 - 2012-01-15 21:52 - 00000000 ____D () C:\Program Files (x86)\Systemtools

2014-07-27 15:18 - 2014-07-27 15:18 - 01029760 _____ () C:\Windows\Minidump\072714-17409-01.dmp

2014-07-27 15:18 - 2013-02-17 18:27 - 00000000 ____D () C:\Windows\Minidump

2014-07-27 15:15 - 2011-10-18 19:22 - 00000000 ____D () D:\Benutzer\Mariano\Portable Anwendungen

2014-07-27 15:03 - 2014-07-27 14:56 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\NPE

2014-07-27 15:01 - 2014-07-27 15:01 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Local\CrashDumps

2014-07-27 13:58 - 2014-07-27 13:58 - 02093568 _____ (Farbar) D:\Benutzer\Mariano\Desktop\FRST64.exe

2014-07-27 13:11 - 2014-07-27 13:11 - 05981830 _____ (Tim Kosse) D:\Benutzer\Mariano\Downloads\FileZilla_3.9.0.1_win32-setup.exe

2014-07-26 10:05 - 2011-11-19 14:11 - 00000000 ____D () D:\Benutzer\Mariano\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-07-11 03:02 - 2014-07-27 18:19 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-07-11 02:56 - 2014-07-27 18:19 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-07-11 02:56 - 2012-03-31 12:07 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-07-11 02:55 - 2012-03-31 12:07 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-07-05 11:57 - 2012-03-02 19:31 - 00002004 ____H () D:\Benutzer\Mariano\Documents\Default.rdp
 

Some content of TEMP:

====================

D:\Benutzer\Mariano\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp8xt_ht.dll

D:\Benutzer\Mariano\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe

D:\Benutzer\Mariano\AppData\Local\Temp\nvSCPAPI.dll

D:\Benutzer\Mariano\AppData\Local\Temp\nvStInst.exe

D:\Benutzer\Mariano\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-04-04 02:16
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Java und Flash updatne.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

D:\Benutzer\Mariano\AppData\LocalLow\RadioTotal1

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen

Danke dir für deine Antwort... Werde ich gleich heute Abend machen!

Frage: Ich habe eine Portable Firefox bei mir drauf - siehe auch im Log das Verzeichnis:
D:\Benutzer\Mariano\Portable Anwendungen\FirefoxPortable\App\Firefox\firefox.exe

Sprich keinen installierten Firefox, was ändert sich für mich an dieser Stelle?

Setz den einfach zurück. Ohne zu deinstallieren, das geht ja nit :D

Moin Schrauber,

hier der Inhalt der Fixlog.txt:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-07-2014

Ran by Mariano at 2014-07-30 03:02:27 Run:1

Running from D:\Benutzer\Mariano\Desktop

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

D:\Benutzer\Mariano\AppData\LocalLow\RadioTotal1

*****************
 

D:\Benutzer\Mariano\AppData\LocalLow\RadioTotal1 => Moved successfully.
 

==== End of Fixlog ====

Sieht gut aus?!

Darf ich dich nach deiner persönlichen Meinung/Erfahrung zu dem Tool Deep Freeze bzw. Tools im Allgemeinen die einen Systemzustand einfrieren und bei jedem Neustart zurücksetzen, in Bezug auf Viren, Würmer und Trojaner befragen?

Thanks Mariano

leider kenn ich so Tools gar nicht, noch nie benutzt.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.