Trojaner-Board - Windows 7: Plus-HD Problem(e)

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Windows 7: Plus-HD Problem(e) (https://www.trojaner-board.de/157583-windows-7-plus-hd-problem-e.html)

Windows 7: Plus-HD Problem(e)

Hallo :)

Ich habe gleich zwei Probleme aufeinmal, wobei ich nicht weiß, ob das eine Problem was mit dem Anderen zu tun hat:

1.) Mein Firefox öffnet vollkommen selbstständig irgendwelche Internetseiten (bzw. im Tab) wie z.B. Casino-/Poker-/Glücksspielseiten, oder vermeintliche Virenscanner-Seiten, oder "Wie du superschnell Geld machen kannst"-Seiten usw.
Das passiert manchmal auch beim surfen im Web oder wenn ich den PC an gelassen habe.
2.) Dieses dämliche Plus-HD-Virus, was bei Suchanfragen oder überhaupt auf Seiten mit Bildern aufkommt, habe ich mir eingefangen.

(Wenn die zwei Probleme nichts miteinander zutun haben, so öffne ich für das 1.) gerne ein neues Thema. Nur kurz Bescheid geben.)

Da die Daten zu groß sind (gemäß Fehlermeldung beim Versuch zu posten),

Der Text, den Sie eingegeben haben, besteht aus 127095 Zeichen und ist damit zu lang. Bitte kürzen Sie den Text auf die maximale Länge von 120000 Zeichen.

habe ich es euch als Datei hochgeladen

Meinen Avira-Log würde ich euch gerne posten, aber wenn ich rechtsklick-> exportieren mache, dann gibt er mir nicht an, wohin er es gespeichert hat. Evtl. wisst ihr Rat?

Viele Grüße,
Ukulele

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Okay, kein Problem:

defogger_disable

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 11:34 on 14/08/2014 (Ukulele)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-08-2014 01

Ran by Ukulele (administrator) on MÜLLDEPONIE on 14-08-2014 11:36:11

Running from C:\Users\Ukulele\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

() C:\OEM\USBDECTION\USBS3S4Detection.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(CinemaP) C:\Program Files (x86)\Cinema-P+-1.2\0b919c88-098f-4dfe-aacb-1330ba047834.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Crossrider) C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe

(Microsoft Corporation) C:\Windows\System32\StikyNot.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe

(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe

(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe

(Frank Böpple) C:\Program Files (x86)\KaloMa\kaloma.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8098848 2009-09-02] (Realtek Semiconductor)

HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-08-13] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [Hotkey Utility] => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [629280 2009-08-18] ()

HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)

HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [128296 2009-12-22] (CyberLink Corp.)

HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-12-22] (Acer Corp.)

HKLM-x32\...\Run: [ATICustomerCare] => C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-05-04] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-07] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [NCUpdateHelper] => C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe [528360 2014-02-17] (NCSOFT Corporation)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [msnmsgr] => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [FlashGet 3] => "C:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe" -minimize

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [CrossRiderPlugin] => C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe [478720 2011-05-16] (Crossrider)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1753280 2014-07-16] (Valve Corporation)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21653096 2014-07-24] (Skype Technologies S.A.)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2010-11-25] (AMD)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [Driver Operating Service] => C:\Users\Ukulele\AppData\Local\Apps\2.0\4KQTGZMG.WYQ\HR9OXQPN.NAE\dros..tion_0000000000000000_0001.0000_b92f9a67277994ec\Driver Operating Service.appref-ms
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3900&r=173610107707pe448v1j5w4521u889

SearchScopes: HKLM-x32 - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE402

SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3320325&octid=EB_ORIGINAL_CTID&ISID=M31E1BC1D-5F4E-4E51-87D5-264B69E7D858&SearchSource=58&CUI=&UM=6&UP=SP7B045FD5-EB96-40ED-8502-9AAB7B1375D6&q={searchTerms}&SSPV=

SearchScopes: HKCU - {1F096B29-E9DA-4D64-8D63-936BE7762CC5} URL = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=b4e0896b00000000000000fff8f667da&tlver=1.4.19.19&affID=17159

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE402

SearchScopes: HKCU - {c99fdc39-a1ae-4b24-8d71-e5274f8d7c54} URL = hxxp://search.hotspotshield.com/g/results.php?c=s&q={searchTerms}

BHO: Cinema-P+-1.2 -> {11111111-1111-1111-1111-110611171162} -> C:\Program Files (x86)\Cinema-P+-1.2\Cinema-P+-1.2-bho64.dll (CinemaP)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Hotspot Shield Class -> {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} -> C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll No File

BHO-x32: Cinema-P+-1.2 -> {11111111-1111-1111-1111-110611171162} -> C:\Program Files (x86)\Cinema-P+-1.2\Cinema-P+-1.2-bho.dll (CinemaP)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: No Name -> {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} ->  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 185.5.8.72 78.46.81.77
 

FireFox:

========

FF ProfilePath: C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default

FF SelectedSearchEngine: Google

FF Homepage: https://www.google.de/ 

FF NetworkProxy: "ftp", "195.245.118.49"

FF NetworkProxy: "ftp_port", 3128

FF NetworkProxy: "http", "195.245.118.49"

FF NetworkProxy: "http_port", 3128

FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"

FF NetworkProxy: "share_proxy_settings", true

FF NetworkProxy: "socks", "195.245.118.49"

FF NetworkProxy: "socks_port", 3128

FF NetworkProxy: "ssl", "195.245.118.49"

FF NetworkProxy: "ssl_port", 3128

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)

FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)

FF SearchPlugin: C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\searchplugins\trovi-search.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Cinema-P+-1.2 - C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\Extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com [2014-08-13]

FF Extension: Zoom Page - C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\Extensions\zoompage@DW-dev.xpi [2012-03-25]

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20]

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\afurladvisor@anchorfree.com [2014-07-30]

FF HKLM-x32\...\Firefox\Extensions: [crossriderapp435@crossrider.com] - C:\ProgramData\CodecCheck\firefox

FF Extension: Premiumplay Codec-C - C:\ProgramData\CodecCheck\firefox [2011-07-04]
 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [dhkplhfnhceodhffomolpfigojocbpcb] - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbar.crx []

CHR HKLM-x32\...\Chrome\Extension: [jpnbdefcbnoefmmcpelplabbkfmfhlho] - C:\ProgramData\CodecCheck\chrome\codec_check.crx [2011-07-04]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-07] (Avira Operations GmbH & Co. KG)

S3 fussvc; C:\Program Files (x86)\Windows Kits\8.0\App Certification Kit\fussvc.exe [139776 2012-07-25] (Microsoft Corporation) [File not signed]

S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-08-13] (globalUpdate) [File not signed]

S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-08-13] (globalUpdate) [File not signed]

R2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4952112 2014-02-04] (INCA Internet Co., Ltd.)

S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)

S2 SystemStoreService; C:\Program Files (x86)\SoftwareUpdater\SystemStore.exe [297984 2014-04-08] () [File not signed]

S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [126976 2012-07-25] (Microsoft Corporation) [File not signed]

S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [759192 2013-09-03] (Tunngle.net GmbH) [File not signed]

R2 USBS3S4Detection; C:\OEM\USBDECTION\USBS3S4Detection.exe [76320 2009-12-09] ()
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-30] (Avira Operations GmbH & Co. KG)

S3 NPPTNT2; C:\Windows\SysWOW64\npptNT2.sys [4682 2005-01-02] (INCA Internet Co., Ltd.) [File not signed]

R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-02-15] (Apple, Inc.) [File not signed]

S3 VSPerfDrv110; C:\Program Files (x86)\Microsoft Visual Studio 11.0\Team Tools\Performance Tools\x64\VSPerfDrv110.sys [70264 2012-07-26] (Microsoft Corporation)

S3 ALSysIO; \??\C:\Users\Ukulele\AppData\Local\Temp\ALSysIO64.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-14 11:36 - 2014-08-14 11:36 - 00019421 _____ () C:\Users\Ukulele\Desktop\FRST.txt

2014-08-14 11:35 - 2014-08-14 11:36 - 00000000 ____D () C:\FRST

2014-08-14 11:35 - 2014-08-14 11:35 - 02100224 _____ (Farbar) C:\Users\Ukulele\Desktop\FRST64.exe

2014-08-14 11:34 - 2014-08-14 11:34 - 00050477 _____ () C:\Users\Ukulele\Desktop\Defogger.exe

2014-08-14 11:34 - 2014-08-14 11:34 - 00000474 _____ () C:\Users\Ukulele\Desktop\defogger_disable.log

2014-08-14 11:34 - 2014-08-14 11:34 - 00000000 _____ () C:\Users\Ukulele\defogger_reenable

2014-08-14 10:48 - 2014-08-14 10:56 - 00200704 _____ () C:\Users\Ukulele\AppData\Local\Temp$$_temp.mdb

2014-08-14 10:48 - 2014-08-14 10:55 - 00000128 _____ () C:\Users\Ukulele\AppData\Local\Temp$$_temp.ldb

2014-08-14 00:39 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll

2014-08-14 00:39 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll

2014-08-14 00:39 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe

2014-08-14 00:39 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll

2014-08-14 00:39 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe

2014-08-14 00:39 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll

2014-08-14 00:38 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe

2014-08-14 00:38 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe

2014-08-13 11:42 - 2014-08-13 11:42 - 00001167 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-08-13 11:33 - 2014-08-13 11:33 - 00013189 _____ () C:\Users\Ukulele\Desktop\bookmarks-2014-08-13.json

2014-08-13 11:31 - 2014-08-13 11:31 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\dlg

2014-08-13 11:28 - 2014-08-13 11:44 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\Deployment

2014-08-13 11:28 - 2014-08-13 11:28 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\Apps\2.0

2014-08-13 11:27 - 2014-08-14 11:32 - 00002624 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4.job

2014-08-13 11:27 - 2014-08-14 11:32 - 00000916 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job

2014-08-13 11:27 - 2014-08-14 11:32 - 00000912 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job

2014-08-13 11:27 - 2014-08-14 11:27 - 00004482 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11.job

2014-08-13 11:27 - 2014-08-14 11:27 - 00004144 _____ () C:\Windows\Tasks\f48992e5-c6c6-4de2-802d-7be3f416c06b.job

2014-08-13 11:27 - 2014-08-14 11:27 - 00003800 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3.job

2014-08-13 11:27 - 2014-08-14 11:27 - 00001794 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-1.job

2014-08-13 11:27 - 2014-08-14 11:27 - 00001682 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5.job

2014-08-13 11:27 - 2014-08-14 11:27 - 00001422 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2.job

2014-08-13 11:27 - 2014-08-14 11:27 - 00001402 _____ () C:\Windows\Tasks\0b919c88-098f-4dfe-aacb-1330ba047834.job

2014-08-13 11:27 - 2014-08-13 11:27 - 00007512 _____ () C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11

2014-08-13 11:27 - 2014-08-13 11:27 - 00007174 _____ () C:\Windows\System32\Tasks\f48992e5-c6c6-4de2-802d-7be3f416c06b

2014-08-13 11:27 - 2014-08-13 11:27 - 00006830 _____ () C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3

2014-08-13 11:27 - 2014-08-13 11:27 - 00005654 _____ () C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4

2014-08-13 11:27 - 2014-08-13 11:27 - 00004824 _____ () C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-1

2014-08-13 11:27 - 2014-08-13 11:27 - 00004712 _____ () C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5

2014-08-13 11:27 - 2014-08-13 11:27 - 00004452 _____ () C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2

2014-08-13 11:27 - 2014-08-13 11:27 - 00004432 _____ () C:\Windows\System32\Tasks\0b919c88-098f-4dfe-aacb-1330ba047834

2014-08-13 11:27 - 2014-08-13 11:27 - 00003914 _____ () C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA

2014-08-13 11:27 - 2014-08-13 11:27 - 00003660 _____ () C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore

2014-08-13 11:27 - 2014-08-13 11:27 - 00001702 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5_user.job

2014-08-13 11:27 - 2014-08-13 11:27 - 00000616 _____ () C:\Windows\Tasks\4719e056-5c76-4ed8-bfc7-ca7bffea4721.job

2014-08-13 11:27 - 2014-08-13 11:27 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\globalUpdate

2014-08-13 11:27 - 2014-08-13 11:27 - 00000000 ____D () C:\Program Files (x86)\globalUpdate

2014-08-13 11:27 - 2014-08-13 11:27 - 00000000 ____D () C:\Program Files (x86)\Cinema-P+-1.2

2014-08-13 11:05 - 2014-08-13 11:05 - 00000000 ____D () C:\Users\Ukulele\Desktop\musik

2014-08-13 09:36 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-13 09:36 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-08-13 09:36 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-08-13 09:36 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-08-13 09:36 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-08-13 09:36 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-08-13 09:36 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-08-13 09:36 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-08-13 09:36 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-08-13 09:36 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-08-13 09:36 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-08-13 09:36 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-08-13 09:36 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-08-13 09:36 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-08-13 09:36 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-08-13 09:36 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-08-13 09:36 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-08-13 09:36 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-08-13 09:36 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-08-13 09:36 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-08-13 09:36 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-08-13 09:36 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-08-13 09:36 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-08-13 09:36 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-08-13 09:36 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-08-13 09:36 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-08-13 09:36 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-08-13 09:36 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-08-13 09:36 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-08-13 09:36 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-08-13 09:36 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-08-13 09:36 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-08-13 09:36 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-08-13 09:36 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-08-13 09:36 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-08-13 09:36 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-08-13 09:36 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-08-13 09:36 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-08-13 09:36 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-08-13 09:36 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-08-13 09:36 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-08-13 09:36 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-08-13 09:36 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-08-13 09:36 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-08-13 09:36 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-08-13 09:36 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-08-13 09:36 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-08-13 09:36 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-08-13 09:36 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-08-13 09:36 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-08-13 09:36 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-08-13 09:36 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-08-13 09:36 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-08-13 09:36 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-08-13 09:36 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-08-13 09:36 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-08-13 09:36 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-08-13 09:36 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-08-13 09:36 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-08-13 09:36 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2014-08-13 09:36 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-08-13 09:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL

2014-08-13 09:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL

2014-08-13 09:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL

2014-08-13 09:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL

2014-08-13 09:36 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL

2014-08-13 09:36 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls

2014-08-13 09:36 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls

2014-08-13 09:36 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-08-13 09:36 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-08-13 09:36 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2014-08-13 09:36 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-08-13 09:36 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-08-13 09:36 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll

2014-08-13 09:36 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe

2014-08-13 09:36 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-08-13 09:36 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-08-13 09:36 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll

2014-08-13 09:33 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-08-13 09:33 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-08-13 09:33 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2014-08-13 09:33 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2014-08-10 23:55 - 2014-08-10 23:55 - 00000050 _____ () C:\Users\Ukulele\Desktop\asd.txt

2014-08-09 23:13 - 2014-08-11 17:57 - 00053474 _____ () C:\Users\Ukulele\Desktop\Guantanamo_NEW.odt

2014-08-09 18:59 - 2014-08-09 19:00 - 00275344 _____ () C:\Windows\Minidump\080914-20264-01.dmp

2014-08-07 22:17 - 2014-08-07 22:17 - 00275344 _____ () C:\Windows\Minidump\080714-21200-01.dmp

2014-08-06 08:25 - 2014-08-06 08:25 - 00275344 _____ () C:\Windows\Minidump\080614-26130-01.dmp

2014-08-05 00:47 - 2014-08-05 00:47 - 00001237 _____ () C:\Users\Public\Desktop\ElsterFormular.lnk

2014-08-05 00:47 - 2014-08-05 00:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular

2014-08-05 00:46 - 2014-08-05 00:46 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular

2014-08-05 00:39 - 2014-08-05 00:45 - 77405552 _____ (Landesfinanzdirektion Thüringen) C:\Users\Ukulele\Desktop\ElsterFormular-15.2.20140326p.exe

2014-08-02 21:37 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-08-02 21:37 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-08-02 21:37 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-08-02 21:37 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-08-02 21:37 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-08-02 21:36 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-08-02 21:36 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-08-02 21:36 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-08-02 21:36 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-08-02 10:05 - 2014-08-02 10:05 - 00275344 _____ () C:\Windows\Minidump\080214-30622-01.dmp

2014-08-01 16:17 - 2014-08-01 16:17 - 00000000 ____D () C:\Users\Ukulele\Desktop\MOFUGG xD

2014-08-01 16:16 - 2014-08-01 16:16 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\TeamViewer

2014-08-01 12:04 - 2014-08-01 12:04 - 00000000 __SHD () C:\Users\Ukulele\AppData\Local\EmieUserList

2014-08-01 12:04 - 2014-08-01 12:04 - 00000000 __SHD () C:\Users\Ukulele\AppData\Local\EmieSiteList

2014-08-01 11:27 - 2014-08-01 11:27 - 00000000 ____D () C:\gravity

2014-08-01 11:22 - 2014-08-01 11:22 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-08-01 11:22 - 2014-08-01 11:22 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-07-30 02:01 - 2014-08-13 11:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-07-29 10:49 - 2014-07-29 10:49 - 00275344 _____ () C:\Windows\Minidump\072914-24632-01.dmp

2014-07-27 10:13 - 2014-07-27 10:13 - 00275344 _____ () C:\Windows\Minidump\072714-26223-01.dmp

2014-07-27 03:35 - 2014-07-27 03:35 - 00006736 _____ () C:\Users\Ukulele\Desktop\Stellenausschreibung.htm

2014-07-27 03:35 - 2014-07-27 03:35 - 00000000 ____D () C:\Users\Ukulele\Desktop\Stellenausschreibung-Dateien

2014-07-26 03:03 - 2014-07-26 03:03 - 00000000 ____D () C:\ProgramData\VS

2014-07-23 09:41 - 2014-07-23 09:41 - 00262144 ____N () C:\Windows\Minidump\072314-25443-01.dmp

2014-07-19 12:31 - 2014-07-19 13:08 - 00020844 _____ () C:\Users\Ukulele\Desktop\Buchhaltung Nachhilfe 2014.ods
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-14 11:36 - 2014-08-14 11:36 - 00019421 _____ () C:\Users\Ukulele\Desktop\FRST.txt

2014-08-14 11:36 - 2014-08-14 11:35 - 00000000 ____D () C:\FRST

2014-08-14 11:35 - 2014-08-14 11:35 - 02100224 _____ (Farbar) C:\Users\Ukulele\Desktop\FRST64.exe

2014-08-14 11:34 - 2014-08-14 11:34 - 00050477 _____ () C:\Users\Ukulele\Desktop\Defogger.exe

2014-08-14 11:34 - 2014-08-14 11:34 - 00000474 _____ () C:\Users\Ukulele\Desktop\defogger_disable.log

2014-08-14 11:34 - 2014-08-14 11:34 - 00000000 _____ () C:\Users\Ukulele\defogger_reenable

2014-08-14 11:34 - 2010-10-21 15:39 - 00000000 ____D () C:\Users\Ukulele

2014-08-14 11:34 - 2007-10-10 13:04 - 01516552 _____ () C:\Windows\WindowsUpdate.log

2014-08-14 11:32 - 2014-08-13 11:27 - 00002624 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4.job

2014-08-14 11:32 - 2014-08-13 11:27 - 00000916 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job

2014-08-14 11:32 - 2014-08-13 11:27 - 00000912 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job

2014-08-14 11:29 - 2010-11-01 20:36 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\Skype

2014-08-14 11:27 - 2014-08-13 11:27 - 00004482 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11.job

2014-08-14 11:27 - 2014-08-13 11:27 - 00004144 _____ () C:\Windows\Tasks\f48992e5-c6c6-4de2-802d-7be3f416c06b.job

2014-08-14 11:27 - 2014-08-13 11:27 - 00003800 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3.job

2014-08-14 11:27 - 2014-08-13 11:27 - 00001794 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-1.job

2014-08-14 11:27 - 2014-08-13 11:27 - 00001682 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5.job

2014-08-14 11:27 - 2014-08-13 11:27 - 00001422 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2.job

2014-08-14 11:27 - 2014-08-13 11:27 - 00001402 _____ () C:\Windows\Tasks\0b919c88-098f-4dfe-aacb-1330ba047834.job

2014-08-14 11:13 - 2012-12-26 19:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-08-14 11:00 - 2014-02-04 22:00 - 00000296 _____ () C:\Windows\Tasks\Digital Sites.job

2014-08-14 10:56 - 2014-08-14 10:48 - 00200704 _____ () C:\Users\Ukulele\AppData\Local\Temp$$_temp.mdb

2014-08-14 10:55 - 2014-08-14 10:48 - 00000128 _____ () C:\Users\Ukulele\AppData\Local\Temp$$_temp.ldb

2014-08-14 10:48 - 2011-01-11 05:44 - 00000000 ____D () C:\Program Files (x86)\KaloMa

2014-08-14 09:26 - 2013-02-05 00:36 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-08-14 09:22 - 2014-07-08 13:53 - 00000000 ___RD () C:\Users\Ukulele\Desktop\MASTERPLAN!

2014-08-14 07:29 - 2009-07-14 06:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-08-14 07:29 - 2009-07-14 06:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-08-14 07:03 - 2013-08-05 01:58 - 00000245 _____ () C:\Users\Ukulele\AppData\Roaming\WB.CFG

2014-08-14 06:26 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-08-14 06:26 - 2009-07-14 06:51 - 00754941 _____ () C:\Windows\setupact.log

2014-08-14 06:26 - 2009-07-14 06:45 - 00368912 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-08-14 06:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-08-14 00:57 - 2009-11-26 19:39 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-08-14 00:50 - 2013-08-07 03:00 - 00000000 ____D () C:\Windows\system32\MRT

2014-08-14 00:46 - 2010-10-24 13:53 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-08-14 00:38 - 2014-05-07 00:21 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-08-13 19:08 - 2009-11-26 19:58 - 01103940 _____ () C:\Windows\PFRO.log

2014-08-13 19:01 - 2012-09-25 08:18 - 00000000 ____D () C:\Program Files (x86)\Freetec

2014-08-13 19:01 - 2012-09-25 08:17 - 00000000 ____D () C:\ProgramData\Package Cache

2014-08-13 18:09 - 2009-07-14 07:13 - 01836146 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-08-13 18:09 - 2007-10-10 22:56 - 00776056 _____ () C:\Windows\system32\perfh007.dat

2014-08-13 18:09 - 2007-10-10 22:56 - 00179582 _____ () C:\Windows\system32\perfc007.dat

2014-08-13 12:01 - 2012-08-19 05:59 - 00000000 ____D () C:\Users\Ukulele\Documents\TubeBox

2014-08-13 11:44 - 2014-08-13 11:28 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\Deployment

2014-08-13 11:42 - 2014-08-13 11:42 - 00001167 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-08-13 11:42 - 2014-07-30 02:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-08-13 11:42 - 2012-05-23 22:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-08-13 11:40 - 2013-10-01 20:46 - 00000000 ____D () C:\Program Files (x86)\Athan

2014-08-13 11:35 - 2013-08-21 02:03 - 00000000 ____D () C:\Program Files (x86)\Audacity

2014-08-13 11:33 - 2014-08-13 11:33 - 00013189 _____ () C:\Users\Ukulele\Desktop\bookmarks-2014-08-13.json

2014-08-13 11:31 - 2014-08-13 11:31 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\dlg

2014-08-13 11:28 - 2014-08-13 11:28 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\Apps\2.0

2014-08-13 11:27 - 2014-08-13 11:27 - 00007512 _____ () C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11

2014-08-13 11:27 - 2014-08-13 11:27 - 00007174 _____ () C:\Windows\System32\Tasks\f48992e5-c6c6-4de2-802d-7be3f416c06b

2014-08-13 11:27 - 2014-08-13 11:27 - 00006830 _____ () C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3

2014-08-13 11:27 - 2014-08-13 11:27 - 00005654 _____ () C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4

2014-08-13 11:27 - 2014-08-13 11:27 - 00004824 _____ () C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-1

2014-08-13 11:27 - 2014-08-13 11:27 - 00004712 _____ () C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5

2014-08-13 11:27 - 2014-08-13 11:27 - 00004452 _____ () C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2

2014-08-13 11:27 - 2014-08-13 11:27 - 00004432 _____ () C:\Windows\System32\Tasks\0b919c88-098f-4dfe-aacb-1330ba047834

2014-08-13 11:27 - 2014-08-13 11:27 - 00003914 _____ () C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA

2014-08-13 11:27 - 2014-08-13 11:27 - 00003660 _____ () C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore

2014-08-13 11:27 - 2014-08-13 11:27 - 00001702 _____ () C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5_user.job

2014-08-13 11:27 - 2014-08-13 11:27 - 00000616 _____ () C:\Windows\Tasks\4719e056-5c76-4ed8-bfc7-ca7bffea4721.job

2014-08-13 11:27 - 2014-08-13 11:27 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\globalUpdate

2014-08-13 11:27 - 2014-08-13 11:27 - 00000000 ____D () C:\Program Files (x86)\globalUpdate

2014-08-13 11:27 - 2014-08-13 11:27 - 00000000 ____D () C:\Program Files (x86)\Cinema-P+-1.2

2014-08-13 11:27 - 2009-11-26 19:47 - 00000000 ____D () C:\Program Files (x86)\Google

2014-08-13 11:05 - 2014-08-13 11:05 - 00000000 ____D () C:\Users\Ukulele\Desktop\musik

2014-08-11 17:57 - 2014-08-09 23:13 - 00053474 _____ () C:\Users\Ukulele\Desktop\Guantanamo_NEW.odt

2014-08-10 23:55 - 2014-08-10 23:55 - 00000050 _____ () C:\Users\Ukulele\Desktop\asd.txt

2014-08-10 09:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-08-09 19:00 - 2014-08-09 18:59 - 00275344 _____ () C:\Windows\Minidump\080914-20264-01.dmp

2014-08-09 18:59 - 2011-02-11 13:31 - 483161106 _____ () C:\Windows\MEMORY.DMP

2014-08-09 18:59 - 2011-02-11 13:31 - 00000000 ____D () C:\Windows\Minidump

2014-08-07 22:17 - 2014-08-07 22:17 - 00275344 _____ () C:\Windows\Minidump\080714-21200-01.dmp

2014-08-07 08:01 - 2010-11-01 20:36 - 00000000 ____D () C:\ProgramData\Skype

2014-08-07 04:06 - 2014-08-13 09:33 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-08-07 04:01 - 2014-08-13 09:33 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-08-06 16:37 - 2013-02-10 16:12 - 00004208 _____ () C:\Windows\System32\Tasks\Software Updater

2014-08-06 08:25 - 2014-08-06 08:25 - 00275344 _____ () C:\Windows\Minidump\080614-26130-01.dmp

2014-08-05 00:48 - 2012-05-30 22:07 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\elsterformular

2014-08-05 00:47 - 2014-08-05 00:47 - 00001237 _____ () C:\Users\Public\Desktop\ElsterFormular.lnk

2014-08-05 00:47 - 2014-08-05 00:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular

2014-08-05 00:46 - 2014-08-05 00:46 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular

2014-08-05 00:46 - 2012-05-30 22:06 - 00000000 ____D () C:\ProgramData\elsterformular

2014-08-05 00:45 - 2014-08-05 00:39 - 77405552 _____ (Landesfinanzdirektion Thüringen) C:\Users\Ukulele\Desktop\ElsterFormular-15.2.20140326p.exe

2014-08-04 00:51 - 2013-10-18 21:09 - 00000000 ____D () C:\ProgramData\Tunngle

2014-08-04 00:51 - 2010-11-01 20:52 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\Tunngle

2014-08-03 17:51 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-08-02 10:05 - 2014-08-02 10:05 - 00275344 _____ () C:\Windows\Minidump\080214-30622-01.dmp

2014-08-01 16:17 - 2014-08-01 16:17 - 00000000 ____D () C:\Users\Ukulele\Desktop\MOFUGG xD

2014-08-01 16:16 - 2014-08-01 16:16 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\TeamViewer

2014-08-01 12:04 - 2014-08-01 12:04 - 00000000 __SHD () C:\Users\Ukulele\AppData\Local\EmieUserList

2014-08-01 12:04 - 2014-08-01 12:04 - 00000000 __SHD () C:\Users\Ukulele\AppData\Local\EmieSiteList

2014-08-01 11:27 - 2014-08-01 11:27 - 00000000 ____D () C:\gravity

2014-08-01 11:22 - 2014-08-01 11:22 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-08-01 11:22 - 2014-08-01 11:22 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-08-01 01:41 - 2014-08-13 09:36 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-01 01:16 - 2014-08-13 09:36 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-07-29 10:49 - 2014-07-29 10:49 - 00275344 _____ () C:\Windows\Minidump\072914-24632-01.dmp

2014-07-27 10:13 - 2014-07-27 10:13 - 00275344 _____ () C:\Windows\Minidump\072714-26223-01.dmp

2014-07-27 03:35 - 2014-07-27 03:35 - 00006736 _____ () C:\Users\Ukulele\Desktop\Stellenausschreibung.htm

2014-07-27 03:35 - 2014-07-27 03:35 - 00000000 ____D () C:\Users\Ukulele\Desktop\Stellenausschreibung-Dateien

2014-07-27 02:54 - 2013-11-30 20:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2010 Express

2014-07-26 03:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared

2014-07-26 03:04 - 2013-10-08 08:25 - 00085888 _____ () C:\Users\Default\AppData\Local\GDIPFONTCACHEV1.DAT

2014-07-26 03:04 - 2013-10-08 08:25 - 00085888 _____ () C:\Users\Default User\AppData\Local\GDIPFONTCACHEV1.DAT

2014-07-26 03:03 - 2014-07-26 03:03 - 00000000 ____D () C:\ProgramData\VS

2014-07-25 16:52 - 2014-08-13 09:36 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-07-25 16:02 - 2014-08-13 09:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-07-25 16:01 - 2014-08-13 09:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-07-25 15:51 - 2014-08-13 09:36 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-07-25 15:30 - 2014-08-13 09:36 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-07-25 15:28 - 2014-08-13 09:36 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-07-25 15:28 - 2014-08-13 09:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-07-25 15:25 - 2014-08-13 09:36 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-07-25 15:25 - 2014-08-13 09:36 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-07-25 15:11 - 2014-08-13 09:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-07-25 15:10 - 2014-08-13 09:36 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-07-25 15:04 - 2014-08-13 09:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-07-25 15:03 - 2014-08-13 09:36 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-07-25 15:00 - 2014-08-13 09:36 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-07-25 15:00 - 2014-08-13 09:36 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-07-25 14:59 - 2014-08-13 09:36 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-07-25 14:47 - 2014-08-13 09:36 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-07-25 14:40 - 2014-08-13 09:36 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-07-25 14:34 - 2014-08-13 09:36 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-07-25 14:34 - 2014-08-13 09:36 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-07-25 14:33 - 2014-08-13 09:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-07-25 14:30 - 2014-08-13 09:36 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-07-25 14:28 - 2014-08-13 09:36 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-07-25 14:28 - 2014-08-13 09:36 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-07-25 14:21 - 2014-08-13 09:36 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-07-25 14:19 - 2014-08-13 09:36 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-07-25 14:18 - 2014-08-13 09:36 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-07-25 14:17 - 2014-08-13 09:36 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-07-25 14:17 - 2014-08-13 09:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-07-25 14:12 - 2014-08-13 09:36 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-07-25 14:10 - 2014-08-13 09:36 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-07-25 14:10 - 2014-08-13 09:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-07-25 14:08 - 2014-08-13 09:36 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-07-25 14:06 - 2014-08-13 09:36 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-07-25 13:52 - 2014-08-13 09:36 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-07-25 13:47 - 2014-08-13 09:36 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-07-25 13:43 - 2014-08-13 09:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-07-25 13:42 - 2014-08-13 09:36 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-07-25 13:39 - 2014-08-13 09:36 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-07-25 13:39 - 2014-08-13 09:36 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-07-25 13:36 - 2014-08-13 09:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-07-25 13:34 - 2014-08-13 09:36 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-07-25 13:29 - 2014-08-13 09:36 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-07-25 13:23 - 2014-08-13 09:36 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-07-25 13:13 - 2014-08-13 09:36 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-07-25 13:07 - 2014-08-13 09:36 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-07-25 13:07 - 2014-08-13 09:36 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-07-25 13:03 - 2014-08-13 09:36 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-07-25 12:52 - 2014-08-13 09:36 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-07-25 12:26 - 2014-08-13 09:36 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-07-25 12:17 - 2014-08-13 09:36 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-07-25 12:09 - 2014-08-13 09:36 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-07-25 12:05 - 2014-08-13 09:36 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-07-25 12:00 - 2014-08-13 09:36 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-07-24 21:45 - 2013-07-27 17:22 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-07-24 10:30 - 2012-05-14 10:45 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-07-24 10:30 - 2012-05-14 10:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-07-24 03:02 - 2012-05-14 10:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2014-07-23 09:41 - 2014-07-23 09:41 - 00262144 ____N () C:\Windows\Minidump\072314-25443-01.dmp

2014-07-20 21:47 - 2010-11-01 19:33 - 00000000 ____D () C:\Users\Ukulele\Documents\My Games

2014-07-19 13:08 - 2014-07-19 12:31 - 00020844 _____ () C:\Users\Ukulele\Desktop\Buchhaltung Nachhilfe 2014.ods

2014-07-16 10:07 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-07-16 05:25 - 2014-08-13 09:36 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-07-16 05:23 - 2014-08-13 09:36 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-07-16 04:46 - 2014-08-13 09:36 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-07-16 04:46 - 2014-08-13 09:36 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2014-07-16 04:12 - 2014-08-13 09:36 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
 

Some content of TEMP:

====================

C:\Users\Ukulele\AppData\Local\Temp\13-12_win7_win8_64_dd_ccc_whql.exe

C:\Users\Ukulele\AppData\Local\Temp\AMPing.exe

C:\Users\Ukulele\AppData\Local\Temp\AskSLib.dll

C:\Users\Ukulele\AppData\Local\Temp\avgnt.exe

C:\Users\Ukulele\AppData\Local\Temp\drm_dyndata_7370014.dll

C:\Users\Ukulele\AppData\Local\Temp\InstallManager_BAB_BAB.exe

C:\Users\Ukulele\AppData\Local\Temp\jre-7u5-windows-i586-iftw.exe

C:\Users\Ukulele\AppData\Local\Temp\MsgPlusUninstall.exe

C:\Users\Ukulele\AppData\Local\Temp\nsd1375.exe

C:\Users\Ukulele\AppData\Local\Temp\nsd6CB0.exe

C:\Users\Ukulele\AppData\Local\Temp\nsf5AE9.exe

C:\Users\Ukulele\AppData\Local\Temp\nsf6018.exe

C:\Users\Ukulele\AppData\Local\Temp\nsi35B9.exe

C:\Users\Ukulele\AppData\Local\Temp\nsi67EE.exe

C:\Users\Ukulele\AppData\Local\Temp\nsk6F3A.exe

C:\Users\Ukulele\AppData\Local\Temp\nsk738E.exe

C:\Users\Ukulele\AppData\Local\Temp\nsp1B76.exe

C:\Users\Ukulele\AppData\Local\Temp\nsq9852.exe

C:\Users\Ukulele\AppData\Local\Temp\nss177B.exe

C:\Users\Ukulele\AppData\Local\Temp\nst2C71.exe

C:\Users\Ukulele\AppData\Local\Temp\nst301A.exe

C:\Users\Ukulele\AppData\Local\Temp\nsu1750.exe

C:\Users\Ukulele\AppData\Local\Temp\nsy326E.exe

C:\Users\Ukulele\AppData\Local\Temp\raptrpatch.exe

C:\Users\Ukulele\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Ukulele\AppData\Local\Temp\tmp2E11.tmp.exe

C:\Users\Ukulele\AppData\Local\Temp\tmp2F0B.exe

C:\Users\Ukulele\AppData\Local\Temp\tmp42D9.exe

C:\Users\Ukulele\AppData\Local\Temp\tmp4604.exe

C:\Users\Ukulele\AppData\Local\Temp\TubeBoxSetup.exe

C:\Users\Ukulele\AppData\Local\Temp\wlsetup-cvr.exe

C:\Users\Ukulele\AppData\Local\Temp\zipsetup.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-08-08 15:51
 

==================== End Of Log ============================

--- --- ---

Addition

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-08-2014 01

Ran by Ukulele at 2014-08-14 11:37:16

Running from C:\Users\Ukulele\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

 Tools for .Net 3.5 - DEU Lang Pack (x32 Version: 3.11.50727 - Microsoft Corporation) Hidden

 Tools for .Net 3.5 (x32 Version: 3.11.50727 - Microsoft Corporation) Hidden

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)

Acer Arcade Deluxe (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.2.7222 - CyberLink Corp.)

Acer Arcade Deluxe (x32 Version: 3.2.7222 - CyberLink Corp.) Hidden

Acer Backup Manager (HKLM-x32\...\InstallShield_{30075A70-B5D2-440B-AFA3-FB2021740121}) (Version: 2.0.2.19 - NewTech Infosystems)

Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)

Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)

Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.2.0812 - Acer Incorporated)

Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3017 - Acer Incorporated)

Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)

Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden

Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)

Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)

Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.)

Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden

AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden

AMD APP SDK Runtime (Version: 10.0.1016.4 - Advanced Micro Devices Inc.) Hidden

AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden

AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden

AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden

AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden

Amnesia: The Dark Descent (HKLM-x32\...\Steam App 57300) (Version:  - Frictional Games)

Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Application Profiles (HKLM-x32\...\{557090F6-9174-B562-71CF-70FD6C7F9895}) (Version: 2.0.3992.39695 - ATI Technologies, Inc.)

ATI AVIVO64 Codecs (Version: 11.6.0.51125 - ATI Technologies Inc.) Hidden

ATI Catalyst Registration (x32 Version: 3.00.0000 - ATI Technologies Inc.) Hidden

ATI Problem Report Wizard (Version: 3.0.804.0 - ATI Technologies) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)

Backup Manager Advance (x32 Version: 2.0.2.19 - NewTech Infosystems) Hidden

Bastion (HKLM-x32\...\Steam App 107100) (Version:  - Supergiant Games)

Batman: Arkham Asylum GOTY Edition (HKLM-x32\...\Steam App 35140) (Version:  - Rocksteady Studios)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Braid (HKLM-x32\...\Steam App 26800) (Version:  - Number None)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2009.1019.2131.36819 - ATI Technologies, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Dark Souls: Prepare to Die Edition (HKLM-x32\...\Steam App 211420) (Version:  - FromSoftware)

Darksiders (HKLM-x32\...\Steam App 50620) (Version:  - Vigil Games)

Devenv-Ressourcen für Microsoft Visual Studio 2012 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Dotfuscator and Analytics Community Edition (x32 Version: 5.5.4521.29298 - PreEmptive Solutions) Hidden

Dotfuscator and Analytics Community Edition Language Pack (x32 Version: 5.5.4521.29298 - PreEmptive Solutions) Hidden

ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen)

Express Zip (HKLM-x32\...\ExpressZip) (Version: 2.18 - NCH Software)

FINAL FANTASY VII (HKLM-x32\...\Steam App 39140) (Version:  - Square Enix)

FINAL FANTASY VIII (HKLM-x32\...\Steam App 39150) (Version:  - SQUARE ENIX)

GeoGebra 4.2 (HKLM-x32\...\GeoGebra 4.2) (Version: 4.2.56.0 - International GeoGebra Institute)

GPL Ghostscript (HKLM\...\GPL Ghostscript 9.06) (Version: 9.06 - Artifex Software Inc.)

Hotfix für Microsoft Visual C++ 2010 Express - DEU (KB2635973) (HKLM-x32\...\{DEEB5FE3-40F5-3C5B-8F85-5306EF3C08F4}.KB2635973) (Version: 1 - Microsoft Corporation)

Hotkey Utility (HKLM-x32\...\Hotkey Utility) (Version: 1.00.3004 - Acer Incorporated)

HydraVision (x32 Version: 4.2.184.0 - ATI Technologies Inc.) Hidden

Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3002 - Acer Incorporated)

ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)

Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)

Japanese Fonts Support For Adobe Reader X (HKLM-x32\...\{AC76BA86-7AD7-5760-0000-A00000000003}) (Version: 10.0.0 - Adobe Systems Incorporated)

Java 7 Update 7 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217007FF}) (Version: 7.0.70 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden

JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)

KaloMa 4.93 (HKLM-x32\...\KaloMa_is1) (Version:  - Frank Böpple)

LIMBO (HKLM-x32\...\Steam App 48000) (Version:  - Playdead)

Lineage II (HKLM-x32\...\{23664DA8-8872-4CF4-A2F2-327CC539823B}) (Version: 4.0.0.2 - NC Interactive, LLC)

LocalESPC (x32 Version: 8.59.25584 - Microsoft Corporation) Hidden

LocalESPCui for de-de (x32 Version: 8.59.25584 - Microsoft) Hidden

Magicka (HKLM-x32\...\Steam App 42910) (Version:  - Arrowhead Game Studios)

Microsoft .NET Framework 1.1 (HKLM-x32\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)

Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{5CBFF3F3-2D40-34EE-BCA5-A95BC19E400D}) (Version: 4.5.50709 - Microsoft Corporation)

Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (HKLM-x32\...\{98B45D1C-6EB1-460D-A87D-2B60678DC105}) (Version: 4.5.50709 - Microsoft Corporation)

Microsoft .NET Framework 4.5 SDK (HKLM-x32\...\{1948E039-EC79-4591-951D-9867A8C14C90}) (Version: 4.5.50709 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000 - Microsoft Corporation) Hidden

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)

Microsoft Help Viewer 1.0 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.0 Language Pack - DEU) (Version: 1.0.30319 - Microsoft Corporation)

Microsoft Help Viewer 1.0 Language Pack - DEU (Version: 1.0.30319 - Microsoft Corporation) Hidden

Microsoft Help Viewer 1.1 (HKLM\...\Microsoft Help Viewer 1.1) (Version: 1.1.40219 - Microsoft Corporation)

Microsoft Help Viewer 1.1 (Version: 1.1.40219 - Microsoft Corporation) Hidden

Microsoft Help Viewer 1.1 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.1 Language Pack - DEU) (Version: 1.1.40219 - Microsoft Corporation)

Microsoft Help Viewer 1.1 Language Pack - DEU (Version: 1.1.40219 - Microsoft Corporation) Hidden

Microsoft Help Viewer 2.0 (HKLM-x32\...\Microsoft Help Viewer 2.0) (Version: 2.0.50727 - Microsoft Corporation)

Microsoft Help Viewer 2.0 (x32 Version: 2.0.50727 - Microsoft Corporation) Hidden

Microsoft Help Viewer 2.0 Language Pack - DEU (HKLM-x32\...\Microsoft Help Viewer 2.0 Language Pack - DEU) (Version: 2.0.50727 - Microsoft Corporation)

Microsoft Help Viewer 2.0 Language Pack - DEU (x32 Version: 2.0.50727 - Microsoft Corporation) Hidden

Microsoft NuGet - Visual Studio 2012 (x32 Version: 2.0.30625.9003 - Microsoft Corporation) Hidden

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office O MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office SharePoint Designer MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)

Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office X MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Portable Library Multi-Targeting Pack (x32 Version: 11.0.50709.17929 - Microsoft Corporation) Hidden

Microsoft Portable Library Multi-Targeting Pack Language Pack - deu (x32 Version: 11.0.50709.17929 - Microsoft Corporation) Hidden

Microsoft Report Viewer Add-On for Visual Studio 2012 (x32 Version: 11.1.2802.16 - Microsoft Corporation) Hidden

Microsoft Report Viewer Add-On für Visual Studio 2012 (x32 Version: 11.1.2802.16 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2008 (64-bit) (HKLM\...\Microsoft SQL Server 10 Release) (Version:  - Microsoft Corporation)

Microsoft SQL Server 2008 (64-bit) (Version:  - Microsoft Corporation) Hidden

Microsoft SQL Server 2008 Browser (HKLM-x32\...\{4AF2248C-B3DF-46FB-9596-87F5DB193689}) (Version: 10.1.2531.0 - Microsoft Corporation)

Microsoft SQL Server 2008 Common Files (Version: 10.0.1600.22 - Microsoft Corporation) Hidden

Microsoft SQL Server 2008 Common Files (Version: 10.1.2531.0 - Microsoft Corporation) Hidden

Microsoft SQL Server 2008 Database Engine Services (Version: 10.1.2531.0 - Microsoft Corporation) Hidden

Microsoft SQL Server 2008 Database Engine Shared (Version: 10.1.2531.0 - Microsoft Corporation) Hidden

Microsoft SQL Server 2008 Native Client (HKLM\...\{8325FD0C-2FDB-46C3-921A-3A78385EA972}) (Version: 10.1.2531.0 - Microsoft Corporation)

Microsoft SQL Server 2008 RsFx Driver (Version: 10.1.2531.0 - Microsoft Corporation) Hidden

Microsoft SQL Server 2012 Data-Tier App Framework  (HKLM\...\{36E619BC-A234-4EC3-849B-779A7C865A45}) (Version: 11.0.2316.0 - Microsoft Corporation)

Microsoft SQL Server 2012 Data-Tier App Framework  (HKLM-x32\...\{FBA6F90E-36EC-4FC9-9B25-3834E3BD46A8}) (Version: 11.0.2316.0 - Microsoft Corporation)

Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{EF18EF0F-96D3-4A6B-9600-2197F1720A15}) (Version: 11.0.2100.60 - Microsoft Corporation)

Microsoft SQL Server 2012 Management Objects (HKLM-x32\...\{6B7B7E62-9F56-4C87-8664-0E20F2CAB03B}) (Version: 11.0.2100.60 - Microsoft Corporation)

Microsoft SQL Server 2012 Management Objects (x64) (HKLM\...\{D4DA7C91-A59F-4C72-BAC4-DF7C76AB1CB8}) (Version: 11.0.2100.60 - Microsoft Corporation)

Microsoft SQL Server 2012 Transact-SQL ScriptDom  (HKLM\...\{13C9CD03-A5FE-4F50-AC8A-17B77C38CC52}) (Version: 11.0.2100.60 - Microsoft Corporation)

Microsoft SQL Server 2012 T-SQL Language Service  (HKLM-x32\...\{28C7A4BB-3966-4373-8376-C11F38290630}) (Version: 11.0.2100.60 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 x64 DEU (HKLM\...\{C3EAE456-7E7A-451F-80EF-F34C7A13C558}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft SQL Server Compact 4.0 SP1 x64 DEU  (HKLM\...\{98225B15-ECF5-4645-B5AC-F8C5E869A5D5}) (Version: 4.0.8876.1 - Microsoft Corporation)

Microsoft SQL Server System CLR Types (HKLM-x32\...\{C668416A-9213-4058-B7F2-01A42D85559D}) (Version: 10.50.1750.9 - Microsoft Corporation)

Microsoft SQL Server System CLR Types (x64) (HKLM\...\{0D432429-C79C-462D-ABD8-4D82B83A954B}) (Version: 10.50.1750.9 - Microsoft Corporation)

Microsoft SQL Server VSS Writer (HKLM\...\{28D06854-572C-4A65-83E5-F8CAF26B9FDC}) (Version: 10.1.2531.0 - Microsoft Corporation)

Microsoft Visual C++  Compilers 2010 Standard - enu - x86 (x32 Version: 10.0.40219 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Runtime - 10.0.40219 (HKLM\...\{1C7C8AAF-A16D-32E8-89E5-F6D165DE0BCE}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219 (HKLM-x32\...\{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 Express - DEU (HKLM-x32\...\Microsoft Visual C++ 2010 Express - DEU) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 Express - DEU (x32 Version: 10.0.40219 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012  x64 Designtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 Compilers - DEU Resources (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 Compilers (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 Core Libraries (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 Extended Libraries (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 Microsoft Foundation Class Libraries (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Debug Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Debug Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU (HKLM\...\{3C983A67-DFB2-3D3D-AD9E-CA1A5A09FD18}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Service Pack 1 (HKLM-x32\...\Microsoft Visual Studio 2010 Service Pack 1) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Service Pack 1 (x32 Version: 10.0.40219 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50701 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.50706 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.50701 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50701 - Microsoft Corporation)

Microsoft Visual Studio 2012 Devenv (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2012 Shell (Minimum) (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2012 Shell (Minimum) Interop Assemblies (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2012 Shell-(Mindest)-Ressourcen (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2012 Tools für SQL Server Compact 4.0 SP1 DEU (x32 Version: 4.0.8876.1 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2012-Leistungserfassungstools - DEU (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2012-Leistungserfassungstools (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2012-Vorbereitung (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio Professional 2012 - DEU (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio Professional 2012 (HKLM-x32\...\{3682f425-c5f9-4fd6-b36a-793f4606b68f}) (Version: 11.0.50727.26 - Microsoft Corporation)

Microsoft Visual Studio Professional 2012 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio Team Foundation Server 2012 Object Model (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio Team Foundation Server 2012 Object Model Language Pack - DEU (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio Team Foundation Server 2012 Team Explorer (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio Team Foundation Server 2012 Team Explorer Language Pack - DEU (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio Ultimate 2012 XAML UI Designer Core (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual Studio Ultimate 2012 XAML UI Designer deu Resources (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Web Deploy dbSqlPackage Provider - DEU (HKLM-x32\...\{86756584-C41A-4CA3-B42D-4768C7720F56}) (Version: 10.3.20225.0 - Microsoft Corporation)

Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)

Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)

Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)

Microsoft-System-CLR-Typen für SQL Server 2012 (HKLM-x32\...\{4C0B27C3-3E8F-4BD2-80FF-6E9E48EBD6D8}) (Version: 11.0.2100.60 - Microsoft Corporation)

Microsoft-System-CLR-Typen für SQL Server 2012 (x64) (HKLM\...\{64A5D39C-95CD-4B8B-B2FA-6C713133B57F}) (Version: 11.0.2100.60 - Microsoft Corporation)

Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

NCSOFT Game Launcher (HKLM-x32\...\NCLauncher_NCWest) (Version:  - NCSOFT)

Nero 9 Essentials (HKLM-x32\...\{9d5299f9-f94e-43ed-9632-a5e045b51f7d}) (Version:  - Nero AG)

Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden

Nero DiscSpeed (x32 Version: 5.4.7.201 - Nero AG) Hidden

Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden

Nero DriveSpeed (x32 Version: 4.4.7.201 - Nero AG) Hidden

Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden

Nero Express Help (x32 Version: 9.4.9.100 - Nero AG) Hidden

Nero InfoTool (x32 Version: 6.4.7.201 - Nero AG) Hidden

Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden

Nero Installer (x32 Version: 4.4.8.1 - Nero AG) Hidden

Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden

Nero StartSmart (x32 Version: 9.4.11.209 - Nero AG) Hidden

Nero StartSmart Help (x32 Version: 9.4.11.208 - Nero AG) Hidden

Nero StartSmart OEM (x32 Version: 9.16.0.100 - Nero AG) Hidden

NeroExpress (x32 Version: 9.4.10.505 - Nero AG) Hidden

neroxml (x32 Version: 1.0.0 - Nero AG) Hidden

Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.36 - Symantec)

NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)

OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)

Path of Exile (HKLM-x32\...\Steam App 238960) (Version:  - Grinding Gear Games)

PDFTK Builder 3.5.3 (HKLM-x32\...\PDFTK Builder_is1) (Version:  - )

Portal (HKLM-x32\...\Steam App 400) (Version:  - Valve)

PreEmptive Analytics Client German Language Pack (x32 Version: 1.0.2180.1 - PreEmptive Solutions) Hidden

PreEmptive Analytics Visual Studio Components (x32 Version: 1.0.2180.1 - PreEmptive Solutions) Hidden

Prince of Persia T2T (HKLM-x32\...\{DFFE2B1F-07E0-45A9-8801-CD8514CAA876}) (Version:  - )

QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)

R for Windows 2.15.1 (HKLM\...\R for Windows 2.15.1_is1) (Version: 2.15.1 - R Core Team)

Ragnarok Online 2 (HKLM-x32\...\Steam App 231060) (Version:  - Gravity, Inc.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5930 - Realtek Semiconductor Corp.)

Recuva (HKLM\...\Recuva) (Version: 1.48 - Piriform)

Saints Row: The Third (HKLM-x32\...\Steam App 55230) (Version:  - Volition)

Sequence (HKLM-x32\...\Steam App 200910) (Version:  - Iridium Studios)

Service Pack 1 für SQL Server 2008 (KB 968369) (64-bit) (HKLM\...\KB968369) (Version: 10.1.2531.0 - Microsoft Corporation)

Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)

Spelunky (HKLM-x32\...\Steam App 239350) (Version:  - )

Sql Server Customer Experience Improvement Program (Version: 10.1.2531.0 - Microsoft Corporation) Hidden

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.13 - TeamSpeak Systems GmbH)

Terraria (HKLM-x32\...\Steam App 105600) (Version:  - Re-Logic)

The Binding of Isaac (HKLM-x32\...\Steam App 113200) (Version:  - Edmund McMillen and Florian Himsl)

The Lord of the Rings FREE Trial  (x32 Version: 1.00.0000 - ATI Technologies Inc.) Hidden

The Stanley Parable (HKLM-x32\...\Steam App 221910) (Version:  - Galactic Cafe)

The Stanley Parable Demo (HKLM-x32\...\Steam App 247750) (Version:  - Galactic Cafe)

Toki Tori (HKLM-x32\...\Steam App 38700) (Version:  - Two Tribes)

Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version:  - Tunngle.net GmbH)

Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (HKLM\...\{6AF73222-EE90-434C-AE7E-B96F70A68D89}) (Version: 10.1.2731.0 - Microsoft Corporation)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)

Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version:  - Microsoft)

Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM-x32\...\{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)

Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version:  - Microsoft)

Update for Microsoft Office Script Editor Help (KB963671) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version:  - Microsoft)

Update for Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version:  - Microsoft)

Update for Microsoft Visual Studio 2012 (KB2781514) (HKLM-x32\...\{56ef8912-352f-4fab-9c73-6f1c92a7127f}) (Version: 11.0.51219 - Microsoft Corporation)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden

Visual Studio 2012 Prerequisites - DEU Language Pack (Version: 11.0.50727 - Microsoft Corporation) Hidden

Visual Studio 2012 Prerequisites (Version: 11.0.50727 - Microsoft Corporation) Hidden

Visual Studio Extensions for Windows Library for JavaScript (x32 Version: 1.0.8514.0 - Microsoft Corporation) Hidden

VLC media player 1.1.4 (HKLM-x32\...\VLC media player) (Version: 1.1.4 - VideoLAN)

WavePad Audio-Editor (HKLM-x32\...\WavePad) (Version: 5.49 - NCH Software)

WCF Data Services 5.0 (for OData v3) DEU Language Pack (x32 Version: 5.0.50628.0 - Microsoft Corporation) Hidden

WCF Data Services 5.0 (for OData v3) Primary Components (x32 Version: 5.0.50628.0 - Microsoft Corporation) Hidden

WCF Data Services Tools for Microsoft Visual Studio 2012 (x32 Version: 5.0.50710.0 - Microsoft Corporation) Hidden

WCF Data Services Tools for Visual Studio 11 DEU Language Pack (x32 Version: 5.0.50710.0 - Microsoft Corporation) Hidden

WCF RIA Services V1.0 SP2 (HKLM-x32\...\{3A523AF9-D32F-4C85-8388-0335731F3405}) (Version: 4.1.61829.0 - Microsoft Corporation)

Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)

Windows App Certification Kit Native Components (Version: 8.59.25584 - Microsoft Corporation) Hidden

Windows App Certification Kit x64 (x32 Version: 8.59.25584 - Microsoft Corporation) Hidden

Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows Live OneCare safety scanner (HKLM-x32\...\Windows Live OneCare safety scanner) (Version:  - Microsoft Corporation)

Windows Live OneCare safety scanner (x32 Version: 1.0.0.0 - Microsoft Corporation) Hidden

Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)

Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

Windows Runtime Intellisense Content - de-de (x32 Version: 8.59.25584 - Microsoft Corporation) Hidden

Windows Software Development Kit (x32 Version: 8.59.25584 - Microsoft Corporation) Hidden

Windows Software Development Kit DirectX x64 Remote (Version: 8.59.25584 - Microsoft Corporation) Hidden

Windows Software Development Kit DirectX x86 Remote (x32 Version: 8.59.25584 - Microsoft Corporation) Hidden

Windows Software Development Kit for Windows Store Apps (x32 Version: 8.59.25584 - Microsoft Corporation) Hidden

Windows Software Development Kit for Windows Store Apps DirectX x64 Remote (Version: 8.59.25584 - Microsoft Corporation) Hidden

Windows Software Development Kit for Windows Store Apps DirectX x86 Remote (x32 Version: 8.59.25584 - Microsoft Corporation) Hidden

WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-1781707443-1315973787-1321434675-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Ukulele\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
 

==================== Restore Points  =========================
 

03-08-2014 17:00:44 Windows-Sicherung

06-08-2014 13:03:11 Windows Update

10-08-2014 19:34:47 Windows-Sicherung

12-08-2014 09:38:11 Windows Update

13-08-2014 09:29:55 TubeBox

13-08-2014 09:31:23 TubeBox

13-08-2014 16:59:22 Secure Download Manager wird entfernt

13-08-2014 17:00:32 TubeBox

13-08-2014 22:37:27 Windows Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2012-01-14 01:50 - 00440137 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1        www.007guard.com

127.0.0.1        007guard.com

127.0.0.1        008i.com

127.0.0.1        www.008k.com

127.0.0.1        008k.com

127.0.0.1        www.00hq.com

127.0.0.1        00hq.com

127.0.0.1        010402.com

127.0.0.1        www.032439.com

127.0.0.1        032439.com

127.0.0.1        www.0scan.com

127.0.0.1        0scan.com

127.0.0.1        1000gratisproben.com

127.0.0.1        www.1000gratisproben.com

127.0.0.1        1001namen.com

127.0.0.1        www.1001namen.com

127.0.0.1        100888290cs.com

127.0.0.1        www.100888290cs.com

127.0.0.1        www.100sexlinks.com

127.0.0.1        100sexlinks.com

127.0.0.1        10sek.com

127.0.0.1        www.10sek.com

127.0.0.1        www.1-2005-search.com

127.0.0.1        1-2005-search.com

127.0.0.1        123fporn.info

127.0.0.1        www.123fporn.info

127.0.0.1        123haustiereundmehr.com

127.0.0.1        www.123haustiereundmehr.com

127.0.0.1        123moviedownload.com
 

There are 1000 more lines.
 
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {06EA1931-515D-4380-AAD0-A72F921B0C78} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)

Task: {0DE64D14-5DB6-4076-90B4-FB2018ABAD49} - System32\Tasks\{29FBF5D0-3A30-4C4C-89F6-9A75207D3DCF} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2014-07-24] (Skype Technologies S.A.)

Task: {13090F1C-32C5-413A-9259-3F22B23B8242} - System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3 => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3.exe [2014-08-13] (CinemaP)

Task: {1D3E50CB-A26B-4AC5-82E2-5D4B8317AE93} - System32\Tasks\DSite => C:\Users\Ukulele\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe [2013-08-05] () <==== ATTENTION

Task: {2580BCBC-3FFF-4807-A684-323D5AE556CF} - System32\Tasks\0b919c88-098f-4dfe-aacb-1330ba047834 => C:\Program Files (x86)\Cinema-P+-1.2\0b919c88-098f-4dfe-aacb-1330ba047834.exe [2014-08-13] (CinemaP)

Task: {444123E7-56CE-48E5-AF99-FAF466BE301B} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-08-13] (globalUpdate)

Task: {50C3B21B-6051-435E-8584-60FDF39E4B3A} - System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4 => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4.exe [2014-08-13] (CinemaP)

Task: {50E0DBFB-7A9B-4F8F-8DC5-4331192962E6} - System32\Tasks\Digital Sites => C:\Users\Ukulele\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: {68C0A56C-263D-4782-9D5E-286D606FE0C7} - System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5 => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5.exe [2014-08-13] (CinemaP)

Task: {6FDA2559-2D8A-4DFF-A085-81B1924C8AAE} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {83ABDCB2-4427-49FA-9BC4-A2E1B86EB2B7} - System32\Tasks\Software Updater => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe [2013-12-19] ()

Task: {A9C70F75-A227-4EF7-9D1E-B39D4A68A1D1} - System32\Tasks\NCH Software\WavePadDowngrade => C:\Program Files (x86)\NCH Software\WavePad\wavepad.exe [2013-06-01] (NCH Software)

Task: {B5D423A9-2E28-474B-B378-CACC57CD372A} - System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2 => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2.exe [2014-08-13] (CinemaP)

Task: {C53FD381-1857-4B00-B040-08A0E73CEF82} - System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-1 => C:\Program Files (x86)\Cinema-P+-1.2\Cinema-P+-1.2-codedownloader.exe [2014-08-13] (CinemaP)

Task: {C74428F7-14FE-4882-91F2-3FC03E04A6B8} - System32\Tasks\f48992e5-c6c6-4de2-802d-7be3f416c06b => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4.exe [2014-08-13] (CinemaP)

Task: {D7EB11B7-9EB5-4D2E-82B4-A43A3AE85868} - System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11 => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11.exe [2014-08-13] (CinemaP)

Task: {F9107EAB-8F24-4510-A623-8651650692B5} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-08-13] (globalUpdate)

Task: {F947196C-AEB9-4102-89AB-AE14DB45970F} - System32\Tasks\Software Updater Ui => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Ui.exe [2013-12-18] ()

Task: C:\Windows\Tasks\0b919c88-098f-4dfe-aacb-1330ba047834.job => C:\Program Files (x86)\Cinema-P+-1.2\0b919c88-098f-4dfe-aacb-1330ba047834.exe

Task: C:\Windows\Tasks\4719e056-5c76-4ed8-bfc7-ca7bffea4721.job => C:\Program Files (x86)\Cinema-P+-1.2\4719e056-5c76-4ed8-bfc7-ca7bffea4721.exe

Task: C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-1.job => C:\Program Files (x86)\Cinema-P+-1.2\Cinema-P+-1.2-codedownloader.exe

Task: C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11.job => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11.exe

Task: C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2.job => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2.exe

Task: C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3.job => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3.exe

Task: C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4.job => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4.exe

Task: C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5.job => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5.exe

Task: C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5_user.job => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\Ukulele\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\DSite.job => C:\Users\Ukulele\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\f48992e5-c6c6-4de2-802d-7be3f416c06b.job => C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4.exe

Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION

Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
 

==================== Loaded Modules (whitelisted) =============
 

2009-12-14 04:19 - 2009-12-09 11:24 - 00076320 _____ () C:\OEM\USBDECTION\USBS3S4Detection.exe

2013-11-29 19:34 - 2013-11-29 19:34 - 00088576 _____ () C:\Program Files (x86)\NCH Software\ExpressZip\ezcm64.dll

2011-01-15 20:55 - 2010-03-15 12:28 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll

2009-08-18 09:27 - 2009-08-18 09:27 - 00629280 _____ () C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe

2009-02-03 03:33 - 2009-02-03 03:33 - 00460199 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll

2008-09-29 03:55 - 2008-09-29 03:55 - 01076224 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll

2009-08-18 09:31 - 2009-08-18 09:31 - 00163840 _____ () C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll

2014-05-21 21:57 - 2014-07-12 02:53 - 01116672 _____ () C:\Program Files (x86)\Steam\libavcodec-55.dll

2014-05-03 07:30 - 2014-07-12 02:53 - 00438784 _____ () C:\Program Files (x86)\Steam\libavutil-53.dll

2014-05-21 21:57 - 2014-07-12 02:53 - 00399360 _____ () C:\Program Files (x86)\Steam\libavformat-55.dll

2014-01-09 01:36 - 2014-07-12 02:53 - 00331264 _____ () C:\Program Files (x86)\Steam\libavresample-1.dll

2013-08-21 14:18 - 2014-06-27 00:40 - 00764416 _____ () C:\Program Files (x86)\Steam\SDL2.dll

2014-05-21 21:57 - 2014-07-16 04:28 - 02139328 _____ () C:\Program Files (x86)\Steam\video.dll

2014-05-21 21:57 - 2014-04-29 02:37 - 00519168 _____ () C:\Program Files (x86)\Steam\libswscale-2.dll

2013-10-08 18:19 - 2014-07-16 04:28 - 01116864 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL

2013-09-10 14:20 - 2014-05-02 01:35 - 20628160 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll

2014-08-13 11:42 - 2014-07-17 07:42 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

2014-07-09 19:14 - 2014-07-09 19:14 - 17029808 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

==================== Faulty Device Manager Devices =============
 

Name: Standardtastatur (PS/2)

Description: Standardtastatur (PS/2)

Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}

Manufacturer: (Standardtastaturen)

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 

Name: Microsoft PS/2-Maus

Description: Microsoft PS/2-Maus

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (08/14/2014 00:45:38 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - Failed to compile c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll because of the following error: The given assembly name or codebase was invalid. (Exception from HRESULT: 0x80131047).
 

Error: (08/14/2014 00:45:38 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - Failed to compile c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll because of the following error: The given assembly name or codebase was invalid. (Exception from HRESULT: 0x80131047).
 

Error: (08/14/2014 00:45:38 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - Failed to compile c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll because of the following error: The given assembly name or codebase was invalid. (Exception from HRESULT: 0x80131047).
 

Error: (08/14/2014 00:45:38 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - Failed to compile c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll because of the following error: The given assembly name or codebase was invalid. (Exception from HRESULT: 0x80131047).
 

Error: (08/14/2014 00:45:38 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - Failed to compile c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll because of the following error: The given assembly name or codebase was invalid. (Exception from HRESULT: 0x80131047).
 

Error: (08/14/2014 00:45:38 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - Failed to compile c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll because of the following error: The given assembly name or codebase was invalid. (Exception from HRESULT: 0x80131047).
 

Error: (08/14/2014 00:45:38 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - Failed to compile c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll because of the following error: The given assembly name or codebase was invalid. (Exception from HRESULT: 0x80131047).
 

Error: (08/14/2014 00:45:38 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - Failed to compile c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll because of the following error: The given assembly name or codebase was invalid. (Exception from HRESULT: 0x80131047).
 

Error: (08/14/2014 00:45:38 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - Failed to compile c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll because of the following error: The given assembly name or codebase was invalid. (Exception from HRESULT: 0x80131047).
 

Error: (08/14/2014 00:45:38 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - Failed to compile c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll because of the following error: The given assembly name or codebase was invalid. (Exception from HRESULT: 0x80131047).
 
 

System errors:

=============

Error: (08/13/2014 06:31:59 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "SQL Server (SQLEXPRESS)" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (08/13/2014 06:31:59 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst SQL Server (SQLEXPRESS) erreicht.
 

Error: (08/13/2014 01:31:53 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
 

Error: (08/12/2014 10:46:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "System Store" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (08/12/2014 10:46:30 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst System Store erreicht.
 

Error: (08/11/2014 01:17:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "SQL Server (SQLEXPRESS)" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (08/11/2014 01:17:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst SQL Server (SQLEXPRESS) erreicht.
 

Error: (08/11/2014 00:49:18 PM) (Source: NetBT) (EventID: 4300) (User: )

Description: Der Treiber konnte nicht erstellt werden.
 

Error: (08/11/2014 00:49:18 PM) (Source: NetBT) (EventID: 4300) (User: )

Description: Der Treiber konnte nicht erstellt werden.
 

Error: (08/11/2014 10:03:13 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht.
 
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2011-01-09 16:11:57.783

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\Ukulele\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2011-01-09 16:11:57.777

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\Ukulele\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2011-01-09 16:11:57.756

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2011-01-09 16:11:57.750

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i3 CPU 530 @ 2.93GHz

Percentage of memory in use: 69%

Total physical RAM: 3959.09 MB

Available physical RAM: 1209.23 MB

Total Pagefile: 7916.37 MB

Available Pagefile: 4542.2 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (Acer) (Fixed) (Total:458.87 GB) (Free:293.2 GB) NTFS

Drive d: (Data) (Fixed) (Total:458.87 GB) (Free:51.44 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 4CF34DCE)

Partition 1: (Not Active) - (Size=14 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=459 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=459 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Gmer

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2014-08-14 12:57:13

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD10 rev.01.0 931,51GB

Running: ym26j88u.exe; Driver: C:\Users\Ukulele\AppData\Local\Temp\pxldapod.sys
 
 

---- Kernel code sections - GMER 2.1 ----
 

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                              fffff800033f3000 16 bytes [8B, E3, 41, 5F, 41, 5E, 41, ...]

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 545                                                                              fffff800033f3011 35 bytes {LEA ECX, [RSP+0x70]; CALL 0x3d64f}
 

---- User code sections - GMER 2.1 ----
 

.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1788] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69    00000000763d1465 2 bytes [3D, 76]

.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1788] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155   00000000763d14bb 2 bytes [3D, 76]

.text     ...                                                                                                                                             * 2

.text     C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                           00000000763d1465 2 bytes [3D, 76]

.text     C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                          00000000763d14bb 2 bytes [3D, 76]

.text     ...                                                                                                                                             * 2

.text     C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000763d1465 2 bytes [3D, 76]

.text     C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000763d14bb 2 bytes [3D, 76]

.text     ...                                                                                                                                             * 2

.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1228] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69    00000000763d1465 2 bytes [3D, 76]

.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1228] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155   00000000763d14bb 2 bytes [3D, 76]

.text     ...                                                                                                                                             * 2
 

---- Registry - GMER 2.1 ----
 

Reg       HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{3A445EAC-7328-4FAF-BC72-5BF9A05E0CAC}@LeaseObtainedTime                     1408012918

Reg       HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{3A445EAC-7328-4FAF-BC72-5BF9A05E0CAC}@T1                                    1408013218

Reg       HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{3A445EAC-7328-4FAF-BC72-5BF9A05E0CAC}@T2                                    1408013443

Reg       HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{3A445EAC-7328-4FAF-BC72-5BF9A05E0CAC}@LeaseTerminatesTime                   1408013518

Reg       HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\1924549955\Groups@Bro\xb4s!                                                  0
 

---- EOF - GMER 2.1 ----

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Code:

ComboFix 14-08-15.01 - Ukulele 15.08.2014   9:13.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3959.2397 [GMT 2:00]

ausgeführt von:: c:\users\Ukulele\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}

SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

c:\program files (x86)\Common Files\Acer GameZone online.ico

c:\users\Ukulele\AppData\Local\assembly\tmp

c:\users\Ukulele\AppData\Roaming\.#

c:\windows\iun6002.exe

c:\windows\SysWow64\DEBUG.log

c:\windows\wininit.ini

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_globalUpdate

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-07-15 bis 2014-08-15  ))))))))))))))))))))))))))))))

.

.

2014-08-15 07:23 . 2014-08-15 07:23        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-08-14 09:35 . 2014-08-14 09:38        --------        d-----w-        C:\FRST

2014-08-13 22:39 . 2014-03-09 21:48        171160        ----a-w-        c:\windows\system32\infocardapi.dll

2014-08-13 22:39 . 2014-03-09 21:47        99480        ----a-w-        c:\windows\SysWow64\infocardapi.dll

2014-08-13 22:39 . 2014-06-30 22:24        8856        ----a-w-        c:\windows\system32\icardres.dll

2014-08-13 22:39 . 2014-06-30 22:14        8856        ----a-w-        c:\windows\SysWow64\icardres.dll

2014-08-13 22:39 . 2014-03-09 21:48        1389208        ----a-w-        c:\windows\system32\icardagt.exe

2014-08-13 22:39 . 2014-03-09 21:47        619672        ----a-w-        c:\windows\SysWow64\icardagt.exe

2014-08-13 22:38 . 2014-06-06 06:16        35480        ----a-w-        c:\windows\SysWow64\TsWpfWrp.exe

2014-08-13 22:38 . 2014-06-06 06:12        35480        ----a-w-        c:\windows\system32\TsWpfWrp.exe

2014-08-13 09:31 . 2014-08-13 09:31        --------        d-----w-        c:\users\Ukulele\AppData\Roaming\dlg

2014-08-13 09:28 . 2014-08-13 09:28        --------        d-----w-        c:\users\Ukulele\AppData\Local\Apps

2014-08-13 09:28 . 2014-08-15 06:01        --------        d-----w-        c:\users\Ukulele\AppData\Local\Deployment

2014-08-13 09:27 . 2014-08-13 09:27        --------        d-----w-        c:\users\Ukulele\AppData\Local\globalUpdate

2014-08-13 09:27 . 2014-08-13 09:27        --------        d-----w-        c:\program files (x86)\globalUpdate

2014-08-13 09:27 . 2014-08-13 09:27        --------        d-----w-        c:\program files (x86)\Cinema-P+-1.2

2014-08-13 07:33 . 2014-08-07 02:06        529920        ----a-w-        c:\windows\system32\aepdu.dll

2014-08-13 07:33 . 2014-07-14 02:02        1216000        ----a-w-        c:\windows\system32\rpcrt4.dll

2014-08-13 07:33 . 2014-07-14 01:40        664064        ----a-w-        c:\windows\SysWow64\rpcrt4.dll

2014-08-13 07:33 . 2014-08-07 02:01        424448        ----a-w-        c:\windows\system32\aeinv.dll

2014-08-12 09:39 . 2014-07-02 03:09        10924376        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{22891772-3549-4EB4-89F5-4B808D62332B}\mpengine.dll

2014-08-07 06:01 . 2014-08-07 06:01        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2014-08-04 22:46 . 2014-08-04 22:46        --------        d-----w-        c:\program files (x86)\ElsterFormular

2014-08-02 19:37 . 2014-05-14 16:23        44512        ----a-w-        c:\windows\system32\wups2.dll

2014-08-02 19:37 . 2014-05-14 16:23        58336        ----a-w-        c:\windows\system32\wuauclt.exe

2014-08-02 19:37 . 2014-05-14 16:23        2477536        ----a-w-        c:\windows\system32\wuaueng.dll

2014-08-02 19:37 . 2014-05-14 16:21        2620928        ----a-w-        c:\windows\system32\wucltux.dll

2014-08-02 19:37 . 2014-05-14 16:23        38880        ----a-w-        c:\windows\system32\wups.dll

2014-08-02 19:37 . 2014-05-14 16:23        36320        ----a-w-        c:\windows\SysWow64\wups.dll

2014-08-02 19:37 . 2014-05-14 16:23        700384        ----a-w-        c:\windows\system32\wuapi.dll

2014-08-02 19:37 . 2014-05-14 16:23        581600        ----a-w-        c:\windows\SysWow64\wuapi.dll

2014-08-02 19:37 . 2014-05-14 16:20        97792        ----a-w-        c:\windows\system32\wudriver.dll

2014-08-02 19:37 . 2014-05-14 16:17        92672        ----a-w-        c:\windows\SysWow64\wudriver.dll

2014-08-02 19:36 . 2014-05-14 07:23        198600        ----a-w-        c:\windows\system32\wuwebv.dll

2014-08-02 19:36 . 2014-05-14 07:23        179656        ----a-w-        c:\windows\SysWow64\wuwebv.dll

2014-08-02 19:36 . 2014-05-14 07:20        36864        ----a-w-        c:\windows\system32\wuapp.exe

2014-08-02 19:36 . 2014-05-14 07:17        33792        ----a-w-        c:\windows\SysWow64\wuapp.exe

2014-08-01 14:16 . 2014-08-01 14:16        --------        d-----w-        c:\users\Ukulele\AppData\Roaming\TeamViewer

2014-08-01 10:04 . 2014-08-01 10:04        --------        d-sh--w-        c:\users\Ukulele\AppData\Local\EmieUserList

2014-08-01 10:04 . 2014-08-01 10:04        --------        d-sh--w-        c:\users\Ukulele\AppData\Local\EmieSiteList

2014-08-01 09:27 . 2014-08-01 09:27        --------        d-----w-        C:\gravity

2014-08-01 09:22 . 2014-08-01 09:22        --------        d-----w-        c:\program files (x86)\NVIDIA Corporation

2014-08-01 09:22 . 2014-08-01 09:22        --------        d-----w-        c:\program files (x86)\AGEIA Technologies

2014-07-26 01:03 . 2014-07-26 01:03        --------        d-----w-        c:\programdata\VS

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-08-13 22:46 . 2010-10-24 11:53        99218768        ----a-w-        c:\windows\system32\MRT.exe

2014-07-27 00:54 . 2013-10-07 16:06        113440        ----a-w-        c:\programdata\Microsoft\VCExpress\10.0\1031\ResourceCache.dll

2014-07-24 19:45 . 2013-07-27 15:22        42040        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2014-07-09 17:14 . 2012-10-16 14:46        699056        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2014-07-09 17:14 . 2012-09-03 18:37        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-07-03 20:15 . 2013-07-27 15:22        117712        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2014-06-18 02:18 . 2014-07-10 14:57        692736        ----a-w-        c:\windows\system32\osk.exe

2014-06-18 01:51 . 2014-07-10 14:57        646144        ----a-w-        c:\windows\SysWow64\osk.exe

2014-06-06 10:10 . 2014-07-10 14:57        624128        ----a-w-        c:\windows\system32\qedit.dll

2014-06-06 09:44 . 2014-07-10 14:57        509440        ----a-w-        c:\windows\SysWow64\qedit.dll

2014-06-05 14:45 . 2014-07-10 14:54        1460736        ----a-w-        c:\windows\system32\lsasrv.dll

2014-06-05 14:26 . 2014-07-10 14:54        22016        ----a-w-        c:\windows\SysWow64\secur32.dll

2014-06-05 14:25 . 2014-07-10 14:54        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll

2014-06-04 23:25 . 2013-07-27 15:22        130584        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2014-05-30 08:08 . 2014-07-10 14:57        210944        ----a-w-        c:\windows\system32\wdigest.dll

2014-05-30 08:08 . 2014-07-10 14:57        86528        ----a-w-        c:\windows\system32\TSpkg.dll

2014-05-30 08:08 . 2014-07-10 14:57        340992        ----a-w-        c:\windows\system32\schannel.dll

2014-05-30 08:08 . 2014-07-10 14:57        314880        ----a-w-        c:\windows\system32\msv1_0.dll

2014-05-30 08:08 . 2014-07-10 14:57        307200        ----a-w-        c:\windows\system32\ncrypt.dll

2014-05-30 08:08 . 2014-07-10 14:57        728064        ----a-w-        c:\windows\system32\kerberos.dll

2014-05-30 08:08 . 2014-07-10 14:57        22016        ----a-w-        c:\windows\system32\credssp.dll

2014-05-30 07:52 . 2014-07-10 14:57        172032        ----a-w-        c:\windows\SysWow64\wdigest.dll

2014-05-30 07:52 . 2014-07-10 14:57        65536        ----a-w-        c:\windows\SysWow64\TSpkg.dll

2014-05-30 07:52 . 2014-07-10 14:57        247808        ----a-w-        c:\windows\SysWow64\schannel.dll

2014-05-30 07:52 . 2014-07-10 14:57        220160        ----a-w-        c:\windows\SysWow64\ncrypt.dll

2014-05-30 07:52 . 2014-07-10 14:57        259584        ----a-w-        c:\windows\SysWow64\msv1_0.dll

2014-05-30 07:52 . 2014-07-10 14:57        550912        ----a-w-        c:\windows\SysWow64\kerberos.dll

2014-05-30 07:52 . 2014-07-10 14:57        17408        ----a-w-        c:\windows\SysWow64\credssp.dll

2014-05-30 06:45 . 2014-07-10 14:57        497152        ----a-w-        c:\windows\system32\drivers\afd.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110611171162}]

2014-08-13 09:27        597360        ----a-w-        c:\program files (x86)\Cinema-P+-1.2\Cinema-P+-1.2-bho.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Driver Operating Service"="c:\users\Ukulele\AppData\Local\Apps\2.0\4KQTGZMG.WYQ\HR9OXQPN.NAE\dros..tion_0000000000000000_0001.0000_b92f9a67277994ec\Driver Operating Service.appref-ms" [X]

"CrossRiderPlugin"="c:\program files (x86)\CrossriderWebApps\Crossrider.exe" [2011-05-15 478720]

"Steam"="c:\program files (x86)\Steam\steam.exe" [2014-07-16 1753280]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-07-24 21653096]

"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2010-11-25 393216]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-08-12 261888]

"Hotkey Utility"="c:\program files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe" [2009-08-18 629280]

"NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-25 588648]

"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-12-22 128296]

"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-12-22 181480]

"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-08-07 751184]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]

"NCUpdateHelper"="c:\program files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe" [2014-02-17 528360]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-12-06 766208]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="userinit.exe"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R2 SystemStoreService;System Store;c:\program files (x86)\SoftwareUpdater\SystemStore.exe  -displayname System Store -servicename SystemStoreService;c:\program files (x86)\SoftwareUpdater\SystemStore.exe  -displayname System Store -servicename SystemStoreService [x]

R3 ALSysIO;ALSysIO;c:\users\Ukulele\AppData\Local\Temp\ALSysIO64.sys;c:\users\Ukulele\AppData\Local\Temp\ALSysIO64.sys [x]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]

R3 globalUpdatem;globalUpdate Update Service (globalUpdatem);c:\program files (x86)\globalUpdate\Update\GoogleUpdate.exe;c:\program files (x86)\globalUpdate\Update\GoogleUpdate.exe [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]

R3 Te.Service;Te.Service;c:\program files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe;c:\program files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe;c:\program files (x86)\Tunngle\TnglCtrl.exe [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]

R4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]

R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys;c:\windows\SYSNATIVE\DRIVERS\RsFx0103.sys [x]

R4 SQLAgent$SQLEXPRESS;SQL Server-Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE;c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe;c:\program files (x86)\Acer\Registration\GregHSRW.exe [x]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [x]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]

S2 USBS3S4Detection;USBS3S4Detection;c:\oem\USBDECTION\USBS3S4Detection.exe;c:\oem\USBDECTION\USBS3S4Detection.exe [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]

S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1k62x64.sys [x]

S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]

S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

Inhalt des "geplante Tasks" Ordners

.

2014-08-15 c:\windows\Tasks\0b919c88-098f-4dfe-aacb-1330ba047834.job

- c:\program files (x86)\Cinema-P+-1.2\0b919c88-098f-4dfe-aacb-1330ba047834.exe [2014-08-13 09:27]

.

2014-08-13 c:\windows\Tasks\4719e056-5c76-4ed8-bfc7-ca7bffea4721.job

- c:\program files (x86)\Cinema-P+-1.2\4719e056-5c76-4ed8-bfc7-ca7bffea4721.exe [2014-08-13 09:27]

.

2014-08-15 c:\windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-1.job

- c:\program files (x86)\Cinema-P+-1.2\Cinema-P+-1.2-codedownloader.exe [2014-08-13 09:27]

.

2014-08-15 c:\windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11.job

- c:\program files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11.exe [2014-08-13 09:27]

.

2014-08-15 c:\windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2.job

- c:\program files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2.exe [2014-08-13 09:27]

.

2014-08-15 c:\windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3.job

- c:\program files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3.exe [2014-08-13 09:27]

.

2014-08-15 c:\windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4.job

- c:\program files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4.exe [2014-08-13 09:27]

.

2014-08-15 c:\windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5.job

- c:\program files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5.exe [2014-08-13 09:27]

.

2014-08-13 c:\windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5_user.job

- c:\program files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5.exe [2014-08-13 09:27]

.

2014-08-15 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-16 17:14]

.

2014-08-15 c:\windows\Tasks\f48992e5-c6c6-4de2-802d-7be3f416c06b.job

- c:\program files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4.exe [2014-08-13 09:27]

.

2014-08-15 c:\windows\Tasks\globalUpdateUpdateTaskMachineCore.job

- c:\program files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-08-13 09:27]

.

2014-08-14 c:\windows\Tasks\globalUpdateUpdateTaskMachineUA.job

- c:\program files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-08-13 09:27]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-09-02 8098848]

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = about:blank

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

mSearchAssistant = hxxp://start.facemoods.com/?a=bf&s={searchTerms}&f=4

IE: ????3??

IE: ????3??????

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Free YouTube to MP3 Converter - c:\users\Ukulele\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html

IE: ????3?? - c:\users\Ukulele\AppData\Roaming\FlashGetBHO\GetUrl.htm

IE: ????3?????? - c:\users\Ukulele\AppData\Roaming\FlashGetBHO\GetAllUrl.htm

LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll

TCP: DhcpNameServer = 185.5.8.72 78.46.81.77

FF - ProfilePath - c:\users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/ 

FF - prefs.js: network.proxy.ftp - 195.245.118.49

FF - prefs.js: network.proxy.ftp_port - 3128

FF - prefs.js: network.proxy.http - 195.245.118.49

FF - prefs.js: network.proxy.http_port - 3128

FF - prefs.js: network.proxy.socks - 195.245.118.49

FF - prefs.js: network.proxy.socks_port - 3128

FF - prefs.js: network.proxy.ssl - 195.245.118.49

FF - prefs.js: network.proxy.ssl_port - 3128

FF - prefs.js: network.proxy.type - 0

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-FlashGet 3 - c:\program files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe

Wow6432Node-HKCU-Run-SpybotSD TeaTimer - c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe

Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

HKLM-Run-mwlDaemon - c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1781707443-1315973787-1321434675-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f3*#N}]

@Allowed: (Read) (RestrictedCode)

@="c:\\Users\\Ukulele\\AppData\\Roaming\\FlashGetBHO\\GetUrl.htm"

"contexts"=dword:00000022

.

[HKEY_USERS\S-1-5-21-1781707443-1315973787-1321434675-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f3*#N}hQèþ”¥c]

@Allowed: (Read) (RestrictedCode)

@="c:\\Users\\Ukulele\\AppData\\Roaming\\FlashGetBHO\\GetAllUrl.htm"

"contexts"=dword:000000f3

.

[HKEY_USERS\S-1-5-21-1781707443-1315973787-1321434675-1000\Software\SecuROM\License information*]

"datasecu"=hex:d9,e5,96,fc,09,1e,93,c1,c3,bf,04,b2,56,ca,08,09,90,aa,b5,42,4a,

   6c,cf,13,36,b2,f2,75,c1,9a,c0,93,7e,b8,91,b0,d5,46,fe,1b,ee,62,54,3f,2b,bd,\

"rkeysecu"=hex:7d,40,10,cb,c7,39,e0,67,0a,69,a8,47,07,da,5b,5c

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.14"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2014-08-15  09:33:48 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2014-08-15 07:33

.

Vor Suchlauf: 16 Verzeichnis(se), 314.227.904.512 Bytes frei

Nach Suchlauf: 22 Verzeichnis(se), 317.623.144.448 Bytes frei

.

- - End Of File - - D2BF7E0BA05D591D6F1F0202743D7C36

A36C5E4F47E84449FF07ED3517B43A31

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

mbam

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 16.08.2014

Suchlauf-Zeit: 11:38:55

Logdatei: mbam.txt

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.08.16.02

Rootkit Datenbank: v2014.08.15.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: Ukulele
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 337082

Verstrichene Zeit: 13 Min, 19 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 1

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\0b919c88-098f-4dfe-aacb-1330ba047834.exe, 1304, Löschen bei Neustart, [3e04fec949321d1953b9defb758d44bc]
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 46

PUP.Optional.SearchProtect.A, HKU\S-1-5-21-1781707443-1315973787-1321434675-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, Löschen bei Neustart, [69d93f884c2f50e66ac27bf01fe3a25e], 

PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{68B81CCD-A80C-4060-8947-5AE69ED01199}, In Quarantäne, [83bfddea5a2110263482f3b18a78c53b], 

PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E6B969FB-6D33-48d2-9061-8BBD4899EB08}, In Quarantäne, [a59dc9fe9be016207f38921254ae04fc], 

PUP.Optional.CrossRider.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061762.BHO, In Quarantäne, [083a2a9d6b1075c1b7d5845ff012c739], 

PUP.Optional.CrossRider.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061762.Sandbox, In Quarantäne, [87bbd8ef9edd2214eaa21fc49f637090], 

PUP.Optional.CrossRider.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0061762.Sandbox.1, In Quarantäne, [90b234930477e254008cc41f22e0f10f], 

PUP.Optional.CrossRider.A, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\19979, In Quarantäne, [8bb77a4ddd9e0d292352a15f5ea5c33d], 

PUP.Optional.CinemaPlus, HKLM\SOFTWARE\WOW6432NODE\Cinema-P+-1.2, In Quarantäne, [b38fe4e3a2d9d95dc9e737a8d2307789], 

PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\Iminent, In Quarantäne, [af93c6013f3c54e2a72042cb9b68c838], 

PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061762.BHO, In Quarantäne, [182a42857ffc8fa72864eaf962a013ed], 

PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061762.Sandbox, In Quarantäne, [ff43f5d20f6c3afc7b1124bf09f91ae6], 

PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0061762.Sandbox.1, In Quarantäne, [93af289f245782b4eaa2e6fd06fc5ca4], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE, In Quarantäne, [2a185473007bbd792d1436afb74b9f61], 

PUP.Optional.Babylon.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dhkplhfnhceodhffomolpfigojocbpcb, In Quarantäne, [67dbb31486f539fdb8cadb683ec68779], 

PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\INSTALLEDBROWSEREXTENSIONS\19979, In Quarantäne, [91b14780c0bb2a0c93e20ef21ee5d12f], 

PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=10, In Quarantäne, [50f29d2ae695171f142e11358c786c94], 

PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=4, In Quarantäne, [bc86f3d46f0c092d67dcbc8a7c886c94], 

PUP.Optional.CinemaPlus, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Cinema-P+-1.2, Löschen bei Neustart, [2c1651760576eb4b318146997e8415eb], 

PUP.Optional.Iminent.A, HKU\S-1-5-21-1781707443-1315973787-1321434675-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Iminent, Löschen bei Neustart, [45fd299e98e396a04187a76647bc3dc3], 

PUP.Optional.CinemaPlus, HKU\S-1-5-21-1781707443-1315973787-1321434675-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Cinema-P+-1.2, Löschen bei Neustart, [073bdaed2358092d06ac7f6056accf31], 

PUP.Optional.CrossRider.A, HKU\S-1-5-21-1781707443-1315973787-1321434675-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Löschen bei Neustart, [89b942851863d36398aabf7830d48b75], 

PUP.Optional.InstallCore.A, HKU\S-1-5-21-1781707443-1315973787-1321434675-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, Löschen bei Neustart, [45fd23a4a0db5fd729a928e452b1ef11], 

PUP.Optional.InstallCore.A, HKU\S-1-5-21-1781707443-1315973787-1321434675-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, Löschen bei Neustart, [c87aa3249cdf6accedfb58cabb495ca4], 

PUP.Optional.CrossRider.A, HKU\S-1-5-21-1781707443-1315973787-1321434675-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\19979, Löschen bei Neustart, [f74b3e892556072f184b4b9406fc2ad6], 

PUP.Optional.CrossRider.A, HKU\S-1-5-21-1781707443-1315973787-1321434675-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\CinemaP, Löschen bei Neustart, [c57dbd0aa6d5c6709aaf09d4778bf10f], 

PUP.Optional.Softonic.A, HKU\S-1-5-21-1781707443-1315973787-1321434675-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, Löschen bei Neustart, [54eefdcaa1da65d14aa48c6f3cc646ba], 

PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdatem, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.OneClickCtrl.10, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.OneClickCtrl.10, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.Update3WebControl.4, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.Update3WebControl.4, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.CinemaPlus, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{11111111-1111-1111-1111-110611171162}, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110611171162}, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, HKU\S-1-5-21-1781707443-1315973787-1321434675-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110611171162}, Löschen bei Neustart, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{22222222-2222-2222-2222-220622172262}, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220622172262}, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 
 

Registrierungswerte: 4

PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE|path, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, In Quarantäne, [2a185473007bbd792d1436afb74b9f61]

PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|crossriderapp435@crossrider.com, C:\ProgramData\CodecCheck\firefox, In Quarantäne, [86bccef9c7b4bb7b7e0ffce7847ec838]

PUP.Optional.InstallCore.A, HKU\S-1-5-21-1781707443-1315973787-1321434675-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0S1G1M1G1I1O2Wzr1C1M, Löschen bei Neustart, [c87aa3249cdf6accedfb58cabb495ca4]

PUP.Optional.CrossRider.A, HKU\S-1-5-21-1781707443-1315973787-1321434675-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\NEW WINDOWS\ALLOW|*.crossrider.com, CR, Löschen bei Neustart, [fa4843842655270f8d9c70d439cb25db]
 

Registrierungsdaten: 1

PUP.Optional.FaceMoods.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://start.facemoods.com/?a=bf&s={searchTerms}&f=4, Gut: (www.google.com), Schlecht: (hxxp://start.facemoods.com/?a=bf&s={searchTerms}&f=4),Ersetzt,[83bf18af1f5c0333cf8412c16f9513ed]
 

Ordner: 36

PUP.Optional.OpenCandy, C:\Users\Ukulele\AppData\Roaming\OpenCandy, In Quarantäne, [be843e89d3a87abc992f6c4b7c86f709], 

PUP.Optional.OpenCandy, C:\Users\Ukulele\AppData\Roaming\OpenCandy\A5E56FCC89CF465990BE31B833342DB6, In Quarantäne, [be843e89d3a87abc992f6c4b7c86f709], 

PUP.Optional.OpenCandy, C:\Users\Ukulele\AppData\Roaming\OpenCandy\C3D56473ACCF477E881A3248E68EE616, In Quarantäne, [be843e89d3a87abc992f6c4b7c86f709], 

PUP.Optional.FaceMoods.A, C:\Users\Ukulele\AppData\LocalLow\facemoods.com, In Quarantäne, [91b17156ef8ce551e41af7c7ce3426da], 

PUP.Optional.FaceMoods.A, C:\Users\Ukulele\AppData\LocalLow\facemoods.com\facemoods, In Quarantäne, [91b17156ef8ce551e41af7c7ce3426da], 

PUP.Optional.FaceMoods.A, C:\Users\Ukulele\AppData\LocalLow\facemoods.com\facemoods\Microsoft, In Quarantäne, [91b17156ef8ce551e41af7c7ce3426da], 

PUP.Optional.FaceMoods.A, C:\Users\Ukulele\AppData\LocalLow\facemoods.com\facemoods\Microsoft\Windows, In Quarantäne, [91b17156ef8ce551e41af7c7ce3426da], 

PUP.Optional.FaceMoods.A, C:\Users\Ukulele\AppData\LocalLow\facemoods.com\facemoods\Microsoft\Windows\IETldCache, In Quarantäne, [91b17156ef8ce551e41af7c7ce3426da], 

PUP.Optional.SimilarSites.A, C:\Users\Ukulele\AppData\Roaming\SimilarSites, In Quarantäne, [0a384186285372c4852366597b876d93], 

PUP.Optional.Babylon.A, C:\Users\Ukulele\AppData\LocalLow\BabylonToolbar, In Quarantäne, [7cc6efd85e1df244a1f8c1084bb79e62], 

PUP.Optional.Babylon.A, C:\Users\Ukulele\AppData\LocalLow\BabylonToolbar\BabylonToolbar, In Quarantäne, [7cc6efd85e1df244a1f8c1084bb79e62], 

PUP.Optional.Babylon.A, C:\Users\Ukulele\AppData\LocalLow\BabylonToolbar\BabylonToolbar\Microsoft, In Quarantäne, [7cc6efd85e1df244a1f8c1084bb79e62], 

PUP.Optional.Babylon.A, C:\Users\Ukulele\AppData\LocalLow\BabylonToolbar\BabylonToolbar\Microsoft\Windows, In Quarantäne, [7cc6efd85e1df244a1f8c1084bb79e62], 

PUP.Optional.Babylon.A, C:\Users\Ukulele\AppData\LocalLow\BabylonToolbar\BabylonToolbar\Microsoft\Windows\IETldCache, In Quarantäne, [7cc6efd85e1df244a1f8c1084bb79e62], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Download, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Install, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline\{4B701CFB-4A58-4778-851B-752AED3845AA}, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.Updater.A, C:\Users\Ukulele\AppData\Roaming\DigitalSites\UpdateProc, In Quarantäne, [ba880dba5f1c1d19386f04d148ba2ed2], 

PUP.Optional.Updater.A, C:\Users\Ukulele\AppData\Roaming\DSite\UpdateProc, In Quarantäne, [45fd8b3c8fec092d3475c70e25ddee12], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\defaults, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\defaults\preferences, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\userCode, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\locale, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\locale\en-US, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2, Löschen bei Neustart, [3e04fec949321d1953b9defb758d44bc], 
 

Dateien: 196

PUP.Optional.Conduit.A, C:\Users\Ukulele\AppData\Roaming\OpenCandy\A5E56FCC89CF465990BE31B833342DB6\sp-downloader.exe, In Quarantäne, [ca787354671475c1e1f98e996d94b44c], 

PUP.Optional.Conduit.A, C:\Users\Ukulele\AppData\Roaming\OpenCandy\C3D56473ACCF477E881A3248E68EE616\sp-downloader.exe, In Quarantäne, [2d154186c1ba310545957daa5fa2de22], 

PUP.Optional.DigitalSites.A, C:\Users\Ukulele\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe, In Quarantäne, [0141982f0a7157df6b9659e4649d8878], 

PUP.Optional.Iminent.A, C:\Users\Ukulele\AppData\Local\DownloadGuide\Offers\iminent.exe, In Quarantäne, [8fb393348fecc2749f5156e22cd51fe1], 

PUP.Optional.OptimizePro.A, C:\Users\Ukulele\AppData\Local\DownloadGuide\Offers\optimizerpro.exe, In Quarantäne, [ca7827a025567eb8104fc35b5da3dd23], 

PUP.Optional.PriceGong.A, C:\Users\Ukulele\AppData\Local\DownloadGuide\Offers\pricegong.exe, In Quarantäne, [172b10b7552661d51e743337926fc33d], 

PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-1, In Quarantäne, [2f137156eb9042f4ed4f9352db27f20e], 

PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11, In Quarantäne, [083a26a1fe7d1a1c4eeeaa3b89799a66], 

PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2, In Quarantäne, [d36f883f3c3f64d291ab2abbc73b629e], 

PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3, In Quarantäne, [40029c2bc9b267cfa894eafbf01229d7], 

PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4, In Quarantäne, [3d05d3f4dc9f64d2013b0cd90cf6d828], 

PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5, In Quarantäne, [370b86416d0e1e18b9837b6a2dd5ba46], 

PUP.Optional.Trovi.A, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\searchplugins\trovi-search.xml, In Quarantäne, [cd756f588af1280e27a3a54f2dd57987], 

PUP.Optional.CrossRider.T, C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-1.job, In Quarantäne, [8cb69136dc9feb4ba1160c37e81c10f0], 

PUP.Optional.CrossRider.T, C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11.job, In Quarantäne, [ab978d3a3249e2545265ef541ee61fe1], 

PUP.Optional.CrossRider.T, C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2.job, In Quarantäne, [65dd428507742c0a4176be8539cbb64a], 

PUP.Optional.CrossRider.T, C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3.job, In Quarantäne, [d76b3f8890ebea4c8d2ae55eb84c1fe1], 

PUP.Optional.CrossRider.T, C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4.job, In Quarantäne, [43ff596efd7e31052493093a4aba9f61], 

PUP.Optional.CrossRider.T, C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5.job, In Quarantäne, [91b11daabac13cfa16a1c083e71de51b], 

PUP.Optional.CrossRider.T, C:\Windows\Tasks\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5_user.job, In Quarantäne, [56ec1fa8512a1b1bc1f69da6cb3948b8], 

PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job, In Quarantäne, [c9798443760573c3735a6cd771936e92], 

PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore, In Quarantäne, [ce74775084f70e284e80e360768eb848], 

PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job, In Quarantäne, [b88a05c2c7b479bd5778380b48bcaf51], 

PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA, In Quarantäne, [ad95ba0db7c465d108c8fd46986ce51b], 

PUP.Optional.CrossRider.A, C:\Windows\Tasks\0b919c88-098f-4dfe-aacb-1330ba047834.job, In Quarantäne, [093991367ffc2f07a39dcf775aaad32d], 

PUP.Optional.CrossRider.A, C:\Windows\Tasks\4719e056-5c76-4ed8-bfc7-ca7bffea4721.job, In Quarantäne, [cb778c3b225943f3e55b64e2b54fa55b], 

PUP.Optional.CrossRider.A, C:\Windows\Tasks\f48992e5-c6c6-4de2-802d-7be3f416c06b.job, In Quarantäne, [8ab841868deedc5a66daf0563aca58a8], 

PUP.Optional.CrossRider.A, C:\Windows\System32\Tasks\0b919c88-098f-4dfe-aacb-1330ba047834, In Quarantäne, [222093347506181e5be651f57f85da26], 

PUP.Optional.CrossRider.A, C:\Windows\System32\Tasks\f48992e5-c6c6-4de2-802d-7be3f416c06b, In Quarantäne, [6ed4b4132853f4428fb2f84e768ea858], 

PUP.Optional.FaceMoods.A, C:\Users\Ukulele\AppData\LocalLow\facemoods.com\facemoods\Microsoft\Windows\IETldCache\index.dat, In Quarantäne, [91b17156ef8ce551e41af7c7ce3426da], 

PUP.Optional.Babylon.A, C:\Users\Ukulele\AppData\LocalLow\BabylonToolbar\BabylonToolbar\Microsoft\Windows\IETldCache\index.dat, In Quarantäne, [7cc6efd85e1df244a1f8c1084bb79e62], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdate.dll, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdateres_en.dll, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psmachine.dll, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psuser.dll, In Quarantäne, [5ae827a0007be45200e45a7727db04fc], 

PUP.Optional.Updater.A, C:\Users\Ukulele\AppData\Roaming\DigitalSites\UpdateProc\config.dat, In Quarantäne, [ba880dba5f1c1d19386f04d148ba2ed2], 

PUP.Optional.Updater.A, C:\Users\Ukulele\AppData\Roaming\DigitalSites\UpdateProc\info.dat, In Quarantäne, [ba880dba5f1c1d19386f04d148ba2ed2], 

PUP.Optional.Updater.A, C:\Users\Ukulele\AppData\Roaming\DigitalSites\UpdateProc\STTL.DAT, In Quarantäne, [ba880dba5f1c1d19386f04d148ba2ed2], 

PUP.Optional.Updater.A, C:\Users\Ukulele\AppData\Roaming\DigitalSites\UpdateProc\TTL.DAT, In Quarantäne, [ba880dba5f1c1d19386f04d148ba2ed2], 

PUP.Optional.Updater.A, C:\Users\Ukulele\AppData\Roaming\DSite\UpdateProc\config.dat, In Quarantäne, [45fd8b3c8fec092d3475c70e25ddee12], 

PUP.Optional.Updater.A, C:\Users\Ukulele\AppData\Roaming\DSite\UpdateProc\info.dat, In Quarantäne, [45fd8b3c8fec092d3475c70e25ddee12], 

PUP.Optional.Updater.A, C:\Users\Ukulele\AppData\Roaming\DSite\UpdateProc\TTL.DAT, In Quarantäne, [45fd8b3c8fec092d3475c70e25ddee12], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome.manifest, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\install.rdf, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\7ee41f6d892dd94293fc231cd9ca6f39.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\9249013ab06956af2f9d8c9b3cff1882.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\a333ca8fca290441694447486d2ed5f7.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\background.html, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\be5c7723e0d4a04d1b9171305d4f9222.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\browser.xul, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\d0eba125c174756bcc4f0caadaaa217f.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\dialog.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\ffCoreFilesIndex.txt, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\ffde4a5309cafd5d935c77e41e55dc1f.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\options.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\options.xul, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\search_dialog.xul, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\b326b4f95f43333bc3c6f41cf2b2b686.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\0271ef8e78c95ceb59df91867e161b29.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\06b1199f49b653976ea7d28b7becc2f1.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\0ba738281fb3150507e9ec808e8a534b.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\0dd9494d3ae0f6d995037dd6d89e3654.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\60184c4197dfb8777d57dd2ec02ea5a9.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\86d6642e61820278334d4329a3f4f398.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\a283399f130f0ddd2ad1a298991fed49.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\b112cd91d8d3758c7e48e8c0f9878eec.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\bb4343479f6b5116f3d5efdb05d69604.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\c0ec6a330527e6b972cfb43214f9f4a0.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\d0aba72bee6b13d1fd4414aa294a3347.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\d3948cd58e2f8c5b2ab592c549a9f6c0.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\f51f1669518eb3f64f0890b158a7d94f.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\f618b150e305b1c5475ad77903f01ff6.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\api\f76f842c010c125287f201b8cf64d41e.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\897e4d340bc7fe4b5c6abe9c7cc9d6f0.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\02da94acae6b4cc26cb2062e5bd807ea.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\0a67483ccaaaefef6c01cb3a79daea62.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\20794042ac666512bab8057a43d13b87.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\60b96484525ae44a5b8838580f8bb67e.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\74558cb7f84d1645688f4277c293f6a8.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\76f45a9d36a42da64049b9adc10a1b5b.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\77b99aaf7bbe6a2c42d6060478e7ad80.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\796e3721e2b79a7f328e66457b510cf4.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\7cb1c42aed738d7158a9e178a39ddd71.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\84fa10539907239bb0ca97ebc1e6886d.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\87c46fd4bf0b42ab60b8c69643988fcb.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\8bfb7ca60f772b66ab7526027c2b5eae.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\8ceee1468f4068dcc8253905987fbd1d.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\9c170e8f4358af48c9e9ecfc7e05ecb8.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\a6bdf97aa4663fa27c1357d8913ef6f0.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\bab1bdae198c97859bb3a24fc06a4a69.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\d94d7115c257c3acd203ff92b420f992.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\dd2192f2753ba1538273b002e4b72c04.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\e7f41e141ec430c4bd0c3621d550d862.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\chrome\content\core\installer.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\defaults\preferences\prefs.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\manifest.xml, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins.json, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\244.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\102.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\104.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\119.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\123.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\13.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\14.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\155.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\16.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\17.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\178.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\179.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\180.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\184.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\190.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\191.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\195.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\198.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\217.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\220.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\221.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\223.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\231.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\232.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\242.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\246.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\259.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\260.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\262.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\263.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\268.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\273.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\275.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\281.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\284.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\286.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\288.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\289.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\300.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\4.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\47.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\64.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\7.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\78.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\9.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\91.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\plugins\93.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\userCode\background.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\extensionData\userCode\extension.js, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\locale\en-US\translations.dtd, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\button1.png, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\button2.png, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\button3.png, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\button4.png, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\button5.png, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\crossrider_statusbar.png, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\icon128.png, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\icon16.png, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\icon24.png, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\icon48.png, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\panelarrow-up.png, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\popup.html, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\skin.css, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CrossRider, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com\skin\update.css, In Quarantäne, [5de5dfe8df9cd462f495993ff70b6d93], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\0b919c88-098f-4dfe-aacb-1330ba047834.exe, Löschen bei Neustart, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\1293297481.mxaddon, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\4719e056-5c76-4ed8-bfc7-ca7bffea4721.exe, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\7ec44bc6-c70f-4cd3-aa16-c1a7ca37c022.crx, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-11.exe, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-2.exe, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-3.exe, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-4.exe, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655-5.exe, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655.crx, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655.xpi, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\ad3e6f4b-46b9-4daf-95e7-3a0f70e9d655_.xpi, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\background.html, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\Cinema-P+-1.2-bg.exe, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\Cinema-P+-1.2-bho.dll, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\Cinema-P+-1.2-bho64.dll, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\Cinema-P+-1.2-codedownloader.exe, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\Cinema-P+-1.2.ico, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\d68628f5-08a6-4780-b0b0-9075ea0adca5.crx, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\Interop.IWshRuntimeLibrary.dll, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\Newtonsoft.Json.dll, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\SuperSocket.ClientEngine.Common.dll, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\SuperSocket.ClientEngine.Core.dll, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\SuperSocket.ClientEngine.Protocol.dll, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\utils.exe, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CinemaPlus, C:\Program Files (x86)\Cinema-P+-1.2\WebSocket4Net.dll, In Quarantäne, [3e04fec949321d1953b9defb758d44bc], 

PUP.Optional.CrossRider.A, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.crossrider.bic", "147ceb5df805aba3d99c7bc5d01be4bd");), Ersetzt,[1e24d0f7e992fa3c0382996a6c99827e]

PUP.Optional.CrossRider.A, C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.crossriderapp435@crossrider.com.install-event-fired", true);), Ersetzt,[71d1c9fe64177bbbfe88838014f19868]
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

AdwCleaner

Code:

# AdwCleaner v3.306 - Bericht erstellt am 16/08/2014 um 12:06:24

# Aktualisiert 15/08/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Ukulele - MÜLLDEPONIE

# Gestartet von : C:\Users\Ukulele\Desktop\adwcleaner_3.306.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

[#] Dienst Gelöscht : SystemStoreService
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\hotspot shield

Ordner Gelöscht : C:\ProgramData\NCH Software

Ordner Gelöscht : C:\ProgramData\Partner

Ordner Gelöscht : C:\ProgramData\Premium

Ordner Gelöscht : C:\Program Files (x86)\Conduit

Ordner Gelöscht : C:\Program Files (x86)\globalUpdate

Ordner Gelöscht : C:\Program Files (x86)\NCH Software

Ordner Gelöscht : C:\Program Files (x86)\SimilarSites

Ordner Gelöscht : C:\Program Files (x86)\SoftwareUpdater

Ordner Gelöscht : C:\Users\Ukulele\AppData\Local\DownloadGuide

Ordner Gelöscht : C:\Users\Ukulele\AppData\Local\globalUpdate

Ordner Gelöscht : C:\Users\Ukulele\AppData\Local\Software_Updater

Ordner Gelöscht : C:\Users\Ukulele\AppData\Local\SoftwareUpdater

Ordner Gelöscht : C:\Users\Ukulele\AppData\Roaming\DigitalSites

Ordner Gelöscht : C:\Users\Ukulele\AppData\Roaming\DSite

Ordner Gelöscht : C:\Users\Ukulele\AppData\Roaming\NCH Software

Ordner Gelöscht : C:\Users\Ukulele\AppData\Roaming\Software Updater

Ordner Gelöscht : C:\Program Files (x86)\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com

Datei Gelöscht : C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
 

***** [ Tasks ] *****
 

Task Gelöscht : DSite

Task Gelöscht : Software Updater Ui

Task Gelöscht : Software Updater
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jpnbdefcbnoefmmcpelplabbkfmfhlho

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonToolbarsrv_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonToolbarsrv_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2604146

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_camstudio_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_camstudio_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_directx_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_directx_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_flashget_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_flashget_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_samsung-kies_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_samsung-kies_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655175562}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666176662}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2974C985-8151-4DE5-B23C-B875F0A8522F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C99FDC39-A1AE-4B24-8D71-E5274F8D7C54}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655175562}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666176662}

Schlüssel Gelöscht : HKCU\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\dsiteproducts

Schlüssel Gelöscht : HKCU\Software\GlobalUpdate

Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider

Schlüssel Gelöscht : HKLM\SOFTWARE\Conduit

Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate

Schlüssel Gelöscht : HKLM\SOFTWARE\InstalledBrowserExtensions

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17239
 
 

-\\ Mozilla Firefox v31.0 (x86 de)
 

[ Datei : C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\prefs.js ]
 

Zeile gelöscht : user_pref("extensions.a0b105cbff1eb40b89bca7dae371d7ead239035fb4613ab38efcom61762.61762.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D[...]

Zeile gelöscht : user_pref("extensions.webbooster@iminent.com.install-event-fired", true);
 

*************************
 

AdwCleaner[R0].txt - [20344 octets] - [16/08/2014 12:02:15]

AdwCleaner[S0].txt - [19443 octets] - [16/08/2014 12:06:24]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [19504 octets] ##########

JRT

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Home Premium x64

Ran by Ukulele on 16.08.2014 at 12:14:19,92

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\crossriderplugin

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\\*.crossrider.com
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\crossrider
 
 
 

~~~ Files
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\ProgramData\codeccheck"

Successfully deleted: [Folder] "C:\Program Files (x86)\crossriderwebapps"
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\Ukulele\AppData\Roaming\mozilla\firefox\profiles\alb42yyf.default\minidumps [1547 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 16.08.2014 at 12:19:12,52

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-08-2014 02

Ran by Ukulele (administrator) on MÜLLDEPONIE on 16-08-2014 12:24:28

Running from C:\Users\Ukulele\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

() C:\OEM\USBDECTION\USBS3S4Detection.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(Microsoft Corporation) C:\Windows\System32\StikyNot.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe

(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe

(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8098848 2009-09-02] (Realtek Semiconductor)

HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-08-13] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [Hotkey Utility] => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [629280 2009-08-18] ()

HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)

HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [128296 2009-12-22] (CyberLink Corp.)

HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-12-22] (Acer Corp.)

HKLM-x32\...\Run: [ATICustomerCare] => C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-05-04] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-07] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [NCUpdateHelper] => C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe [528360 2014-02-17] (NCSOFT Corporation)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1753280 2014-07-16] (Valve Corporation)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21653096 2014-07-24] (Skype Technologies S.A.)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2010-11-25] (AMD)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [Driver Operating Service] => C:\Users\Ukulele\AppData\Local\Apps\2.0\4KQTGZMG.WYQ\HR9OXQPN.NAE\dros..tion_0000000000000000_0001.0000_b92f9a67277994ec\Driver Operating Service.appref-ms

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [CrossRiderPlugin] => C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE402

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 185.5.8.72 78.46.81.77
 

FireFox:

========

FF ProfilePath: C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default

FF SelectedSearchEngine: Google

FF Homepage: https://www.google.de/ 

FF NetworkProxy: "ftp", "195.245.118.49"

FF NetworkProxy: "ftp_port", 3128

FF NetworkProxy: "http", "195.245.118.49"

FF NetworkProxy: "http_port", 3128

FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"

FF NetworkProxy: "share_proxy_settings", true

FF NetworkProxy: "socks", "195.245.118.49"

FF NetworkProxy: "socks_port", 3128

FF NetworkProxy: "ssl", "195.245.118.49"

FF NetworkProxy: "ssl_port", 3128

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Zoom Page - C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\Extensions\zoompage@DW-dev.xpi [2012-03-25]
 

Chrome: 

=======
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-07] (Avira Operations GmbH & Co. KG)

S3 fussvc; C:\Program Files (x86)\Windows Kits\8.0\App Certification Kit\fussvc.exe [139776 2012-07-25] (Microsoft Corporation) [File not signed]

R2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4952112 2014-02-04] (INCA Internet Co., Ltd.)

S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)

S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [126976 2012-07-25] (Microsoft Corporation) [File not signed]

S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [759192 2013-09-03] (Tunngle.net GmbH) [File not signed]

R2 USBS3S4Detection; C:\OEM\USBDECTION\USBS3S4Detection.exe [76320 2009-12-09] ()
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-30] (Avira Operations GmbH & Co. KG)

S3 NPPTNT2; C:\Windows\SysWOW64\npptNT2.sys [4682 2005-01-02] (INCA Internet Co., Ltd.) [File not signed]

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-02-15] (Apple, Inc.) [File not signed]

S3 VSPerfDrv110; C:\Program Files (x86)\Microsoft Visual Studio 11.0\Team Tools\Performance Tools\x64\VSPerfDrv110.sys [70264 2012-07-26] (Microsoft Corporation)

S3 ALSysIO; \??\C:\Users\Ukulele\AppData\Local\Temp\ALSysIO64.sys [X]

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-16 12:23 - 2014-08-16 12:23 - 00000000 ____D () C:\Users\Ukulele\Desktop\FRST-OlderVersion

2014-08-16 12:19 - 2014-08-16 12:19 - 00001251 _____ () C:\Users\Ukulele\Desktop\JRT.txt

2014-08-16 12:14 - 2014-08-16 12:14 - 00000000 ____D () C:\Windows\ERUNT

2014-08-16 12:13 - 2014-08-16 12:13 - 01016261 _____ (Thisisu) C:\Users\Ukulele\Desktop\JRT.exe

2014-08-16 12:11 - 2014-08-16 12:11 - 00019777 _____ () C:\Users\Ukulele\Desktop\AdwCleaner[S0].txt

2014-08-16 12:02 - 2014-08-16 12:06 - 00000000 ____D () C:\AdwCleaner

2014-08-16 12:01 - 2014-08-16 12:01 - 01361203 _____ () C:\Users\Ukulele\Desktop\adwcleaner_3.306.exe

2014-08-16 12:01 - 2014-08-16 12:01 - 00058757 _____ () C:\Users\Ukulele\Desktop\mbam.txt

2014-08-16 11:38 - 2014-08-16 11:59 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-16 11:37 - 2014-08-16 11:37 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-16 11:37 - 2014-08-16 11:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-16 11:37 - 2014-08-16 11:37 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-16 11:37 - 2014-08-16 11:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-16 11:37 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-08-16 11:37 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-08-16 11:37 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-08-16 11:36 - 2014-08-16 11:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Ukulele\Desktop\mbam-setup-2.0.2.1012.exe

2014-08-15 09:33 - 2014-08-15 09:33 - 00026728 _____ () C:\ComboFix.txt

2014-08-15 09:10 - 2014-08-15 09:33 - 00000000 ____D () C:\Qoobox

2014-08-15 09:10 - 2014-08-15 09:32 - 00000000 ____D () C:\Windows\erdnt

2014-08-15 09:10 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-08-15 09:10 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-08-15 09:10 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-08-15 09:10 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-08-15 09:10 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-08-15 09:10 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-08-15 09:10 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-08-15 09:10 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-08-15 09:08 - 2014-08-15 09:09 - 05571320 ____R (Swearware) C:\Users\Ukulele\Desktop\ComboFix.exe

2014-08-15 00:05 - 2014-08-15 00:05 - 00021570 _____ () C:\Users\Ukulele\Desktop\254991506_interesting_xlarge.jpeg

2014-08-14 15:53 - 2014-08-14 15:53 - 00455824 _____ () C:\Windows\Minidump\081414-40061-01.dmp

2014-08-14 12:57 - 2014-08-14 13:32 - 00003829 _____ () C:\Users\Ukulele\Desktop\Gmer.txt

2014-08-14 12:32 - 2014-08-14 12:32 - 00380416 _____ () C:\Users\Ukulele\Desktop\ym26j88u.exe

2014-08-14 11:49 - 2014-08-14 11:49 - 00005826 _____ () C:\Users\Ukulele\Documents\Ereignisse.txt

2014-08-14 11:37 - 2014-08-14 11:47 - 00062086 _____ () C:\Users\Ukulele\Desktop\Addition.txt

2014-08-14 11:36 - 2014-08-16 12:24 - 00015091 _____ () C:\Users\Ukulele\Desktop\FRST.txt

2014-08-14 11:35 - 2014-08-16 12:24 - 00000000 ____D () C:\FRST

2014-08-14 11:35 - 2014-08-16 12:23 - 02101248 _____ (Farbar) C:\Users\Ukulele\Desktop\FRST64.exe

2014-08-14 11:34 - 2014-08-14 12:32 - 00000478 _____ () C:\Users\Ukulele\Desktop\defogger_disable.log

2014-08-14 11:34 - 2014-08-14 11:34 - 00050477 _____ () C:\Users\Ukulele\Desktop\Defogger.exe

2014-08-14 11:34 - 2014-08-14 11:34 - 00000000 _____ () C:\Users\Ukulele\defogger_reenable

2014-08-14 00:39 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll

2014-08-14 00:39 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll

2014-08-14 00:39 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe

2014-08-14 00:39 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll

2014-08-14 00:39 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe

2014-08-14 00:39 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll

2014-08-14 00:38 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe

2014-08-14 00:38 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe

2014-08-13 11:42 - 2014-08-13 11:42 - 00001167 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-08-13 11:33 - 2014-08-13 11:33 - 00013189 _____ () C:\Users\Ukulele\Desktop\bookmarks-2014-08-13.json

2014-08-13 11:31 - 2014-08-13 11:31 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\dlg

2014-08-13 11:28 - 2014-08-16 07:02 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\Apps\2.0

2014-08-13 11:28 - 2014-08-15 08:01 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\Deployment

2014-08-13 11:05 - 2014-08-13 11:05 - 00000000 ____D () C:\Users\Ukulele\Desktop\musik

2014-08-13 09:36 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-13 09:36 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-08-13 09:36 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-08-13 09:36 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-08-13 09:36 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-08-13 09:36 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-08-13 09:36 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-08-13 09:36 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-08-13 09:36 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-08-13 09:36 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-08-13 09:36 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-08-13 09:36 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-08-13 09:36 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-08-13 09:36 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-08-13 09:36 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-08-13 09:36 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-08-13 09:36 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-08-13 09:36 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-08-13 09:36 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-08-13 09:36 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-08-13 09:36 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-08-13 09:36 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-08-13 09:36 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-08-13 09:36 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-08-13 09:36 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-08-13 09:36 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-08-13 09:36 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-08-13 09:36 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-08-13 09:36 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-08-13 09:36 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-08-13 09:36 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-08-13 09:36 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-08-13 09:36 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-08-13 09:36 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-08-13 09:36 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-08-13 09:36 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-08-13 09:36 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-08-13 09:36 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-08-13 09:36 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-08-13 09:36 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-08-13 09:36 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-08-13 09:36 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-08-13 09:36 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-08-13 09:36 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-08-13 09:36 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-08-13 09:36 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-08-13 09:36 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-08-13 09:36 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-08-13 09:36 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-08-13 09:36 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-08-13 09:36 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-08-13 09:36 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-08-13 09:36 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-08-13 09:36 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-08-13 09:36 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-08-13 09:36 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-08-13 09:36 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-08-13 09:36 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-08-13 09:36 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-08-13 09:36 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2014-08-13 09:36 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-08-13 09:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL

2014-08-13 09:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL

2014-08-13 09:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL

2014-08-13 09:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL

2014-08-13 09:36 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL

2014-08-13 09:36 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls

2014-08-13 09:36 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls

2014-08-13 09:36 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-08-13 09:36 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-08-13 09:36 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2014-08-13 09:36 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-08-13 09:36 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-08-13 09:36 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll

2014-08-13 09:36 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe

2014-08-13 09:36 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-08-13 09:36 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-08-13 09:36 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll

2014-08-13 09:33 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-08-13 09:33 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-08-13 09:33 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2014-08-13 09:33 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2014-08-10 23:55 - 2014-08-10 23:55 - 00000050 _____ () C:\Users\Ukulele\Desktop\asd.txt

2014-08-09 23:13 - 2014-08-11 17:57 - 00053474 _____ () C:\Users\Ukulele\Desktop\Guantanamo_NEW.odt

2014-08-09 18:59 - 2014-08-09 19:00 - 00275344 _____ () C:\Windows\Minidump\080914-20264-01.dmp

2014-08-07 22:17 - 2014-08-07 22:17 - 00275344 _____ () C:\Windows\Minidump\080714-21200-01.dmp

2014-08-06 08:25 - 2014-08-06 08:25 - 00275344 _____ () C:\Windows\Minidump\080614-26130-01.dmp

2014-08-05 00:47 - 2014-08-05 00:47 - 00001237 _____ () C:\Users\Public\Desktop\ElsterFormular.lnk

2014-08-05 00:47 - 2014-08-05 00:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular

2014-08-05 00:46 - 2014-08-05 00:46 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular

2014-08-05 00:39 - 2014-08-05 00:45 - 77405552 _____ (Landesfinanzdirektion Thüringen) C:\Users\Ukulele\Desktop\ElsterFormular-15.2.20140326p.exe

2014-08-02 21:37 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-08-02 21:37 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-08-02 21:37 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-08-02 21:37 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-08-02 21:37 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-08-02 21:36 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-08-02 21:36 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-08-02 21:36 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-08-02 21:36 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-08-02 10:05 - 2014-08-02 10:05 - 00275344 _____ () C:\Windows\Minidump\080214-30622-01.dmp

2014-08-01 16:17 - 2014-08-01 16:17 - 00000000 ____D () C:\Users\Ukulele\Desktop\MOFUGG xD

2014-08-01 16:16 - 2014-08-01 16:16 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\TeamViewer

2014-08-01 12:04 - 2014-08-01 12:04 - 00000000 __SHD () C:\Users\Ukulele\AppData\Local\EmieUserList

2014-08-01 12:04 - 2014-08-01 12:04 - 00000000 __SHD () C:\Users\Ukulele\AppData\Local\EmieSiteList

2014-08-01 11:27 - 2014-08-01 11:27 - 00000000 ____D () C:\gravity

2014-08-01 11:22 - 2014-08-01 11:22 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-08-01 11:22 - 2014-08-01 11:22 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-07-30 02:01 - 2014-08-13 11:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-07-29 10:49 - 2014-07-29 10:49 - 00275344 _____ () C:\Windows\Minidump\072914-24632-01.dmp

2014-07-27 10:13 - 2014-07-27 10:13 - 00275344 _____ () C:\Windows\Minidump\072714-26223-01.dmp

2014-07-27 03:35 - 2014-07-27 03:35 - 00006736 _____ () C:\Users\Ukulele\Desktop\Stellenausschreibung.htm

2014-07-27 03:35 - 2014-07-27 03:35 - 00000000 ____D () C:\Users\Ukulele\Desktop\Stellenausschreibung-Dateien

2014-07-26 03:03 - 2014-07-26 03:03 - 00000000 ____D () C:\ProgramData\VS

2014-07-23 09:41 - 2014-07-23 09:41 - 00262144 ____N () C:\Windows\Minidump\072314-25443-01.dmp

2014-07-19 12:31 - 2014-07-19 13:08 - 00020844 _____ () C:\Users\Ukulele\Desktop\Buchhaltung Nachhilfe 2014.ods
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-16 12:25 - 2014-08-14 11:36 - 00015091 _____ () C:\Users\Ukulele\Desktop\FRST.txt

2014-08-16 12:24 - 2014-08-14 11:35 - 00000000 ____D () C:\FRST

2014-08-16 12:23 - 2014-08-16 12:23 - 00000000 ____D () C:\Users\Ukulele\Desktop\FRST-OlderVersion

2014-08-16 12:23 - 2014-08-14 11:35 - 02101248 _____ (Farbar) C:\Users\Ukulele\Desktop\FRST64.exe

2014-08-16 12:19 - 2014-08-16 12:19 - 00001251 _____ () C:\Users\Ukulele\Desktop\JRT.txt

2014-08-16 12:17 - 2009-07-14 06:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-08-16 12:17 - 2009-07-14 06:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-08-16 12:14 - 2014-08-16 12:14 - 00000000 ____D () C:\Windows\ERUNT

2014-08-16 12:13 - 2014-08-16 12:13 - 01016261 _____ (Thisisu) C:\Users\Ukulele\Desktop\JRT.exe

2014-08-16 12:13 - 2013-02-05 00:36 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-08-16 12:13 - 2012-12-26 19:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-08-16 12:13 - 2010-11-01 20:36 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\Skype

2014-08-16 12:11 - 2014-08-16 12:11 - 00019777 _____ () C:\Users\Ukulele\Desktop\AdwCleaner[S0].txt

2014-08-16 12:08 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-08-16 12:08 - 2009-07-14 06:51 - 00755389 _____ () C:\Windows\setupact.log

2014-08-16 12:07 - 2009-11-26 19:58 - 01176326 _____ () C:\Windows\PFRO.log

2014-08-16 12:07 - 2007-10-10 13:04 - 01622913 _____ () C:\Windows\WindowsUpdate.log

2014-08-16 12:06 - 2014-08-16 12:02 - 00000000 ____D () C:\AdwCleaner

2014-08-16 12:01 - 2014-08-16 12:01 - 01361203 _____ () C:\Users\Ukulele\Desktop\adwcleaner_3.306.exe

2014-08-16 12:01 - 2014-08-16 12:01 - 00058757 _____ () C:\Users\Ukulele\Desktop\mbam.txt

2014-08-16 11:59 - 2014-08-16 11:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-16 11:57 - 2009-07-14 06:45 - 00368912 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-08-16 11:37 - 2014-08-16 11:37 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-16 11:37 - 2014-08-16 11:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-16 11:37 - 2014-08-16 11:37 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-16 11:37 - 2014-08-16 11:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-16 11:37 - 2014-08-16 11:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Ukulele\Desktop\mbam-setup-2.0.2.1012.exe

2014-08-16 11:32 - 2013-08-05 01:58 - 00000247 _____ () C:\Users\Ukulele\AppData\Roaming\WB.CFG

2014-08-16 07:02 - 2014-08-13 11:28 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\Apps\2.0

2014-08-15 18:49 - 2014-07-08 13:53 - 00000000 ___RD () C:\Users\Ukulele\Desktop\MASTERPLAN!

2014-08-15 12:54 - 2009-07-14 07:13 - 01836146 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-08-15 12:54 - 2007-10-10 22:56 - 00776056 _____ () C:\Windows\system32\perfh007.dat

2014-08-15 12:54 - 2007-10-10 22:56 - 00179582 _____ () C:\Windows\system32\perfc007.dat

2014-08-15 09:33 - 2014-08-15 09:33 - 00026728 _____ () C:\ComboFix.txt

2014-08-15 09:33 - 2014-08-15 09:10 - 00000000 ____D () C:\Qoobox

2014-08-15 09:33 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-08-15 09:32 - 2014-08-15 09:10 - 00000000 ____D () C:\Windows\erdnt

2014-08-15 09:28 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-08-15 09:09 - 2014-08-15 09:08 - 05571320 ____R (Swearware) C:\Users\Ukulele\Desktop\ComboFix.exe

2014-08-15 08:01 - 2014-08-13 11:28 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\Deployment

2014-08-15 00:05 - 2014-08-15 00:05 - 00021570 _____ () C:\Users\Ukulele\Desktop\254991506_interesting_xlarge.jpeg

2014-08-14 16:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-08-14 15:53 - 2014-08-14 15:53 - 00455824 _____ () C:\Windows\Minidump\081414-40061-01.dmp

2014-08-14 15:53 - 2011-02-11 13:31 - 823211026 _____ () C:\Windows\MEMORY.DMP

2014-08-14 15:53 - 2011-02-11 13:31 - 00000000 ____D () C:\Windows\Minidump

2014-08-14 13:32 - 2014-08-14 12:57 - 00003829 _____ () C:\Users\Ukulele\Desktop\Gmer.txt

2014-08-14 12:32 - 2014-08-14 12:32 - 00380416 _____ () C:\Users\Ukulele\Desktop\ym26j88u.exe

2014-08-14 12:32 - 2014-08-14 11:34 - 00000478 _____ () C:\Users\Ukulele\Desktop\defogger_disable.log

2014-08-14 12:32 - 2011-01-11 05:44 - 00000000 ____D () C:\Program Files (x86)\KaloMa

2014-08-14 11:49 - 2014-08-14 11:49 - 00005826 _____ () C:\Users\Ukulele\Documents\Ereignisse.txt

2014-08-14 11:47 - 2014-08-14 11:37 - 00062086 _____ () C:\Users\Ukulele\Desktop\Addition.txt

2014-08-14 11:34 - 2014-08-14 11:34 - 00050477 _____ () C:\Users\Ukulele\Desktop\Defogger.exe

2014-08-14 11:34 - 2014-08-14 11:34 - 00000000 _____ () C:\Users\Ukulele\defogger_reenable

2014-08-14 11:34 - 2010-10-21 15:39 - 00000000 ____D () C:\Users\Ukulele

2014-08-14 06:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-08-14 00:57 - 2009-11-26 19:39 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-08-14 00:50 - 2013-08-07 03:00 - 00000000 ____D () C:\Windows\system32\MRT

2014-08-14 00:46 - 2010-10-24 13:53 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-08-14 00:38 - 2014-05-07 00:21 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-08-13 19:01 - 2012-09-25 08:18 - 00000000 ____D () C:\Program Files (x86)\Freetec

2014-08-13 19:01 - 2012-09-25 08:17 - 00000000 ____D () C:\ProgramData\Package Cache

2014-08-13 12:01 - 2012-08-19 05:59 - 00000000 ____D () C:\Users\Ukulele\Documents\TubeBox

2014-08-13 11:42 - 2014-08-13 11:42 - 00001167 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-08-13 11:42 - 2014-07-30 02:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-08-13 11:42 - 2012-05-23 22:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-08-13 11:40 - 2013-10-01 20:46 - 00000000 ____D () C:\Program Files (x86)\Athan

2014-08-13 11:35 - 2013-08-21 02:03 - 00000000 ____D () C:\Program Files (x86)\Audacity

2014-08-13 11:33 - 2014-08-13 11:33 - 00013189 _____ () C:\Users\Ukulele\Desktop\bookmarks-2014-08-13.json

2014-08-13 11:31 - 2014-08-13 11:31 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\dlg

2014-08-13 11:27 - 2009-11-26 19:47 - 00000000 ____D () C:\Program Files (x86)\Google

2014-08-13 11:05 - 2014-08-13 11:05 - 00000000 ____D () C:\Users\Ukulele\Desktop\musik

2014-08-11 17:57 - 2014-08-09 23:13 - 00053474 _____ () C:\Users\Ukulele\Desktop\Guantanamo_NEW.odt

2014-08-10 23:55 - 2014-08-10 23:55 - 00000050 _____ () C:\Users\Ukulele\Desktop\asd.txt

2014-08-10 09:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-08-09 19:00 - 2014-08-09 18:59 - 00275344 _____ () C:\Windows\Minidump\080914-20264-01.dmp

2014-08-07 22:17 - 2014-08-07 22:17 - 00275344 _____ () C:\Windows\Minidump\080714-21200-01.dmp

2014-08-07 08:01 - 2010-11-01 20:36 - 00000000 ____D () C:\ProgramData\Skype

2014-08-07 04:06 - 2014-08-13 09:33 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-08-07 04:01 - 2014-08-13 09:33 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-08-06 08:25 - 2014-08-06 08:25 - 00275344 _____ () C:\Windows\Minidump\080614-26130-01.dmp

2014-08-05 00:48 - 2012-05-30 22:07 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\elsterformular

2014-08-05 00:47 - 2014-08-05 00:47 - 00001237 _____ () C:\Users\Public\Desktop\ElsterFormular.lnk

2014-08-05 00:47 - 2014-08-05 00:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular

2014-08-05 00:46 - 2014-08-05 00:46 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular

2014-08-05 00:46 - 2012-05-30 22:06 - 00000000 ____D () C:\ProgramData\elsterformular

2014-08-05 00:45 - 2014-08-05 00:39 - 77405552 _____ (Landesfinanzdirektion Thüringen) C:\Users\Ukulele\Desktop\ElsterFormular-15.2.20140326p.exe

2014-08-04 00:51 - 2013-10-18 21:09 - 00000000 ____D () C:\ProgramData\Tunngle

2014-08-04 00:51 - 2010-11-01 20:52 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\Tunngle

2014-08-02 10:05 - 2014-08-02 10:05 - 00275344 _____ () C:\Windows\Minidump\080214-30622-01.dmp

2014-08-01 16:17 - 2014-08-01 16:17 - 00000000 ____D () C:\Users\Ukulele\Desktop\MOFUGG xD

2014-08-01 16:16 - 2014-08-01 16:16 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\TeamViewer

2014-08-01 12:04 - 2014-08-01 12:04 - 00000000 __SHD () C:\Users\Ukulele\AppData\Local\EmieUserList

2014-08-01 12:04 - 2014-08-01 12:04 - 00000000 __SHD () C:\Users\Ukulele\AppData\Local\EmieSiteList

2014-08-01 11:27 - 2014-08-01 11:27 - 00000000 ____D () C:\gravity

2014-08-01 11:22 - 2014-08-01 11:22 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-08-01 11:22 - 2014-08-01 11:22 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-08-01 01:41 - 2014-08-13 09:36 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-01 01:16 - 2014-08-13 09:36 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-07-29 10:49 - 2014-07-29 10:49 - 00275344 _____ () C:\Windows\Minidump\072914-24632-01.dmp

2014-07-27 10:13 - 2014-07-27 10:13 - 00275344 _____ () C:\Windows\Minidump\072714-26223-01.dmp

2014-07-27 03:35 - 2014-07-27 03:35 - 00006736 _____ () C:\Users\Ukulele\Desktop\Stellenausschreibung.htm

2014-07-27 03:35 - 2014-07-27 03:35 - 00000000 ____D () C:\Users\Ukulele\Desktop\Stellenausschreibung-Dateien

2014-07-27 02:54 - 2013-11-30 20:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2010 Express

2014-07-26 03:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared

2014-07-26 03:04 - 2013-10-08 08:25 - 00085888 _____ () C:\Users\Default\AppData\Local\GDIPFONTCACHEV1.DAT

2014-07-26 03:04 - 2013-10-08 08:25 - 00085888 _____ () C:\Users\Default User\AppData\Local\GDIPFONTCACHEV1.DAT

2014-07-26 03:03 - 2014-07-26 03:03 - 00000000 ____D () C:\ProgramData\VS

2014-07-25 16:52 - 2014-08-13 09:36 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-07-25 16:02 - 2014-08-13 09:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-07-25 16:01 - 2014-08-13 09:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-07-25 15:51 - 2014-08-13 09:36 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-07-25 15:30 - 2014-08-13 09:36 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-07-25 15:28 - 2014-08-13 09:36 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-07-25 15:28 - 2014-08-13 09:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-07-25 15:25 - 2014-08-13 09:36 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-07-25 15:25 - 2014-08-13 09:36 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-07-25 15:11 - 2014-08-13 09:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-07-25 15:10 - 2014-08-13 09:36 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-07-25 15:04 - 2014-08-13 09:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-07-25 15:03 - 2014-08-13 09:36 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-07-25 15:00 - 2014-08-13 09:36 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-07-25 15:00 - 2014-08-13 09:36 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-07-25 14:59 - 2014-08-13 09:36 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-07-25 14:47 - 2014-08-13 09:36 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-07-25 14:40 - 2014-08-13 09:36 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-07-25 14:34 - 2014-08-13 09:36 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-07-25 14:34 - 2014-08-13 09:36 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-07-25 14:33 - 2014-08-13 09:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-07-25 14:30 - 2014-08-13 09:36 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-07-25 14:28 - 2014-08-13 09:36 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-07-25 14:28 - 2014-08-13 09:36 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-07-25 14:21 - 2014-08-13 09:36 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-07-25 14:19 - 2014-08-13 09:36 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-07-25 14:18 - 2014-08-13 09:36 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-07-25 14:17 - 2014-08-13 09:36 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-07-25 14:17 - 2014-08-13 09:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-07-25 14:12 - 2014-08-13 09:36 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-07-25 14:10 - 2014-08-13 09:36 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-07-25 14:10 - 2014-08-13 09:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-07-25 14:08 - 2014-08-13 09:36 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-07-25 14:06 - 2014-08-13 09:36 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-07-25 13:52 - 2014-08-13 09:36 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-07-25 13:47 - 2014-08-13 09:36 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-07-25 13:43 - 2014-08-13 09:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-07-25 13:42 - 2014-08-13 09:36 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-07-25 13:39 - 2014-08-13 09:36 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-07-25 13:39 - 2014-08-13 09:36 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-07-25 13:36 - 2014-08-13 09:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-07-25 13:34 - 2014-08-13 09:36 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-07-25 13:29 - 2014-08-13 09:36 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-07-25 13:23 - 2014-08-13 09:36 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-07-25 13:13 - 2014-08-13 09:36 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-07-25 13:07 - 2014-08-13 09:36 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-07-25 13:07 - 2014-08-13 09:36 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-07-25 13:03 - 2014-08-13 09:36 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-07-25 12:52 - 2014-08-13 09:36 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-07-25 12:26 - 2014-08-13 09:36 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-07-25 12:17 - 2014-08-13 09:36 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-07-25 12:09 - 2014-08-13 09:36 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-07-25 12:05 - 2014-08-13 09:36 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-07-25 12:00 - 2014-08-13 09:36 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-07-24 21:45 - 2013-07-27 17:22 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-07-24 10:30 - 2012-05-14 10:45 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-07-24 10:30 - 2012-05-14 10:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-07-24 03:02 - 2012-05-14 10:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2014-07-23 09:41 - 2014-07-23 09:41 - 00262144 ____N () C:\Windows\Minidump\072314-25443-01.dmp

2014-07-20 21:47 - 2010-11-01 19:33 - 00000000 ____D () C:\Users\Ukulele\Documents\My Games

2014-07-19 13:08 - 2014-07-19 12:31 - 00020844 _____ () C:\Users\Ukulele\Desktop\Buchhaltung Nachhilfe 2014.ods
 

Some content of TEMP:

====================

C:\Users\Ukulele\AppData\Local\Temp\avgnt.exe

C:\Users\Ukulele\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-08-08 15:51
 

==================== End Of Log ============================

--- --- ---

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=37c1929efe5a654f82f0202d9d7e952f

# engine=19700

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2014-08-17 09:58:40

# local_time=2014-08-17 11:58:40 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Avira Desktop'

# compatibility_mode=1810 16777213 100 100 37199 152811939 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 187498 159942570 0 0

# scanned=436210

# found=46

# cleaned=0

# scan_time=33164

sh=A47739F27C4BC8FD3A48B4A90B40679DF1218E1B ft=1 fh=ab4f3351c96b3042 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir"

sh=BC4AF78CFE083FC375445D079DF0AB5171A85EDD ft=1 fh=747cb20379d7e303 vn="möglicherweise Variante von Win32/Bundled.Toolbar.Google.C potenziell unsichere Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe.vir"

sh=CAFC5F8E028371A142AAE51D35B75E8A04F647C7 ft=1 fh=94fcdce65e5dedde vn="möglicherweise Variante von Win32/Bundled.Toolbar.Google.C potenziell unsichere Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\ExpressZip\expresszipsetup_v2.18.exe.vir"

sh=13DBAA23CCA3CF1C7ADC8514D0D704862FCF5CB0 ft=1 fh=6146cfbb8ef73d9d vn="Variante von MSIL/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ukulele\AppData\Roaming\Software Updater\Downloads\out.exe.vir"

sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe"

sh=B5B41E946960F17050C00A4891CFF46B08486A4D ft=1 fh=79895fd74f1827db vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\Adobe\Shockwave 12\gt.exe"

sh=E32AA2E78D2C8F0E9316080E71A714BEFE851E6C ft=1 fh=374915f71a49693e vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\ApnIC[1].0"

sh=B5B41E946960F17050C00A4891CFF46B08486A4D ft=1 fh=79895fd74f1827db vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Windows\SysWOW64\Adobe\Shockwave 12\gt.exe"

sh=E32AA2E78D2C8F0E9316080E71A714BEFE851E6C ft=1 fh=374915f71a49693e vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\ApnIC[1].0"

sh=C7E507F7142FC6B7FC5EF5785A68B7EEDAC1B0E7 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2010-10-24 135630\Backup Files 2010-11-07 190001\Backup files 1.zip"

sh=F7727538B05B861A35929DE1B9578068504467A3 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2010-11-14 190001\Backup Files 2010-11-14 190001\Backup files 2.zip"

sh=D0359C7DED2E4292C1A9CBDF2BC85FAEA019665F ft=0 fh=0000000000000000 vn="Variante von Win32/HotSpotShield evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2010-11-14 190001\Backup Files 2010-12-12 190002\Backup files 1.zip"

sh=763F1C26A61AC90952B7CDB1401C648D6A54AFA4 ft=0 fh=0000000000000000 vn="Variante von Win32/HotSpotShield evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2010-12-19 190001\Backup Files 2010-12-19 190001\Backup files 2.zip"

sh=7153FEF0B52BAD6290264DBF513901D2B70C9BFA ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2010-12-19 190001\Backup Files 2010-12-19 190001\Backup files 3.zip"

sh=EFAFD955F0BE150CBBA243B07483C57D093123B7 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2011-04-11 003848\Backup Files 2011-06-19 195316\Backup files 1.zip"

sh=F6109DBEE9C4C42AB3FEC7AC5B661B420DBB3A11 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2011-04-11 003848\Backup Files 2011-07-03 221218\Backup files 5.zip"

sh=A0E77E4DADCE3AFC6C4F77CDFFDB31A35F487349 ft=0 fh=0000000000000000 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2011-11-13 220948\Backup Files 2011-11-13 220948\Backup files 4.zip"

sh=F56155395A5A4933F92FB49CD9D90DE5E64C8DF8 ft=0 fh=0000000000000000 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2011-11-27 211126\Backup Files 2011-11-27 211126\Backup files 4.zip"

sh=71F6FECB51E775B59E9F9AC4C7E37B15499E4CC9 ft=0 fh=0000000000000000 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2011-12-31 154047\Backup Files 2011-12-31 154047\Backup files 4.zip"

sh=1E2762390AD8F19A5109414C7E35AAD134B1FDB2 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2012-03-12 200318\Backup Files 2012-03-25 201031\Backup files 1.zip"

sh=E14EF69F8C1F787956AA86C45F685E84B5FA0E20 ft=0 fh=0000000000000000 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2012-04-15 200953\Backup Files 2012-05-06 210837\Backup files 6.zip"

sh=22583C3B06E19D76076248F8ECAA8B50CC7DAC2E ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2012-06-10 190003\Backup Files 2012-06-17 190002\Backup files 1.zip"

sh=C96D15C7553C1F876DCF3C07A4E30B6CA8EFFB8C ft=0 fh=0000000000000000 vn="Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2012-08-26 190001\Backup Files 2012-08-26 190001\Backup files 8.zip"

sh=946141A6510849D6C4607EC6E93B0843C8CFBCA4 ft=0 fh=0000000000000000 vn="Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2012-09-09 221021\Backup Files 2012-09-09 221021\Backup files 7.zip"

sh=0E1EAB3199E10F6329FC1CC539912F10CEFDFFD2 ft=0 fh=0000000000000000 vn="Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2012-09-23 202025\Backup Files 2012-09-23 202025\Backup files 8.zip"

sh=3F0FAC9749B528801841CF47F7AA3F115016FCAD ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-02-17 190003\Backup Files 2013-02-24 190002\Backup files 1.zip"

sh=4EA9E3A6250C47A224C8508398742944DD1C0F9D ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-03-03 190003\Backup Files 2013-03-03 190003\Backup files 2.zip"

sh=D3FD05E2690F89F504FC584FE26F43741C855BDE ft=0 fh=0000000000000000 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-03-03 190003\Backup Files 2013-03-25 172532\Backup files 2.zip"

sh=D31903A15EF04A5648C419E591923C9ED12DD91F ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-04-01 211339\Backup Files 2013-04-01 211339\Backup files 2.zip"

sh=82454641CCCFE3C0125113F42C673999EB3CC6C1 ft=0 fh=0000000000000000 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-04-01 211339\Backup Files 2013-04-01 211339\Backup files 5.zip"

sh=6D46F7BAEB9C742959BD57797C70A106D0CF03CE ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-05-12 190002\Backup Files 2013-05-12 190002\Backup files 2.zip"

sh=BDEB675022AA7FB5462C84FB33A093979F3CBCFB ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-07-01 005912\Backup Files 2013-07-01 005912\Backup files 2.zip"

sh=65110F7ED4F58F56FFEB98B83B64DD8C2968CF91 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-07-28 234438\Backup Files 2013-07-28 234438\Backup files 2.zip"

sh=E95566AFB188FC6890C45E08150DE391FF206AA0 ft=0 fh=0000000000000000 vn="Variante von Win32/DealPly.H evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-08-12 040044\Backup Files 2013-08-12 040044\Backup files 1.zip"

sh=ECC7DC6C87160056196FFE158C881755FBD3E065 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-08-12 040044\Backup Files 2013-08-12 040044\Backup files 2.zip"

sh=F0804254062A2953D4C96B4F321A764C92A0CF15 ft=0 fh=0000000000000000 vn="PHP/Small.NAY.Gen Trojaner" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-08-12 040044\Backup Files 2013-08-12 040044\Backup files 3.zip"

sh=C55E3AAA88FAB5496482059F9AB83EFC3003ED32 ft=0 fh=0000000000000000 vn="Variante von Win32/DealPly.H evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-09-23 105920\Backup Files 2013-09-23 105920\Backup files 2.zip"

sh=21C4597A196C15A3BD42E5F49676520E4CD8EF8F ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-09-23 105920\Backup Files 2013-09-23 105920\Backup files 3.zip"

sh=DAE6B8CCC8342175098803475A11ED7F4F926AC6 ft=0 fh=0000000000000000 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-09-23 105920\Backup Files 2013-09-23 105920\Backup files 5.zip"

sh=ADF51BDE7DE36A188C25BE46C525F54CA4402378 ft=0 fh=0000000000000000 vn="Variante von Win32/DealPly.H evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-10-20 190002\Backup Files 2013-10-20 190002\Backup files 1.zip"

sh=34F9C14905A0E2C99B18262548BCAE78051D1D37 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-10-20 190002\Backup Files 2013-10-20 190002\Backup files 2.zip"

sh=2AF0A71A647348541F28CE8D46C5762CDF165D6C ft=0 fh=0000000000000000 vn="Variante von Win32/DealPly.S evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-10-20 190002\Backup Files 2014-02-09 205941\Backup files 1.zip"

sh=0DBF9A155D7E06B90274E1DD21C1C6C2EB9089FA ft=0 fh=0000000000000000 vn="Variante von Win32/DealPly.S evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2013-10-20 190002\Backup Files 2014-02-17 091512\Backup files 1.zip"

sh=262EC81E84EDEED3689DB6C79C8EA278AD3852BD ft=0 fh=0000000000000000 vn="Variante von Win32/DealPly.S evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2014-03-10 095409\Backup Files 2014-03-10 095409\Backup files 1.zip"

sh=A3A87A2B4FA83267192EBF53D7A838CD80C078A1 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2014-03-10 095409\Backup Files 2014-03-10 095409\Backup files 2.zip"

sh=9CAAABBF7F617B5D89EDBB218E508AE38842B802 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="D:\MÜLLDEPONIE\Backup Set 2014-03-10 095409\Backup Files 2014-05-11 190002\Backup files 1.zip"

Code:

 Results of screen317's Security Check version 0.99.87  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Avira Desktop   

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

 JavaFX 2.1.1    

 Java 7 Update 7  

 Visual Studio Extensions for Windows Library for JavaScript 

 Java version out of Date! 

 Adobe Flash Player 14.0.0.145  

 Mozilla Firefox (31.0) 
 ````````Process Check: objlist.exe by Laurent````````  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

Der ESET Scanner hat stolze 8,5h gebraucht für den Scan. Ist/war das normal? :)

Das Problem mit Plus-HD hat sich anscheinend gelöst, da ich es seither nirgendswo mehr gefunden habe. Vielen Dank, Schrauber!
Was das plötzliche aufmachen von Seiten anbelangt, denke ich, dass sich das auch gelöst hat. Bisher kam es nicht wieder :)

Empfiehlst du mir noch irgendwas zu machen?

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-08-2014 01

Ran by Ukulele (administrator) on MÜLLDEPONIE on 18-08-2014 00:11:27

Running from C:\Users\Ukulele\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(Microsoft Corporation) C:\Windows\System32\StikyNot.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe

(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe

(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

() C:\OEM\USBDECTION\USBS3S4Detection.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8098848 2009-09-02] (Realtek Semiconductor)

HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-08-13] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [Hotkey Utility] => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [629280 2009-08-18] ()

HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)

HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [128296 2009-12-22] (CyberLink Corp.)

HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-12-22] (Acer Corp.)

HKLM-x32\...\Run: [ATICustomerCare] => C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-05-04] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-07] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [NCUpdateHelper] => C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe [528360 2014-02-17] (NCSOFT Corporation)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1753280 2014-07-16] (Valve Corporation)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21653096 2014-07-24] (Skype Technologies S.A.)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2010-11-25] (AMD)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [Driver Operating Service] => C:\Users\Ukulele\AppData\Local\Apps\2.0\4KQTGZMG.WYQ\HR9OXQPN.NAE\dros..tion_0000000000000000_0001.0000_b92f9a67277994ec\Driver Operating Service.appref-ms

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\Run: [CrossRiderPlugin] => C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe

HKU\S-1-5-21-1781707443-1315973787-1321434675-1000\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_14_0_0_145_Plugin.exe [851632 2014-07-09] (Adobe Systems Incorporated)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE402

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 185.5.8.72 78.46.81.77
 

FireFox:

========

FF ProfilePath: C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default

FF SelectedSearchEngine: Google

FF Homepage: https://www.google.de/ 

FF NetworkProxy: "ftp", "195.245.118.49"

FF NetworkProxy: "ftp_port", 3128

FF NetworkProxy: "http", "195.245.118.49"

FF NetworkProxy: "http_port", 3128

FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"

FF NetworkProxy: "share_proxy_settings", true

FF NetworkProxy: "socks", "195.245.118.49"

FF NetworkProxy: "socks_port", 3128

FF NetworkProxy: "ssl", "195.245.118.49"

FF NetworkProxy: "ssl_port", 3128

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Zoom Page - C:\Users\Ukulele\AppData\Roaming\Mozilla\Firefox\Profiles\alb42yyf.default\Extensions\zoompage@DW-dev.xpi [2012-03-25]
 

Chrome: 

=======
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-07] (Avira Operations GmbH & Co. KG)

S3 fussvc; C:\Program Files (x86)\Windows Kits\8.0\App Certification Kit\fussvc.exe [139776 2012-07-25] (Microsoft Corporation) [File not signed]

S2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4952112 2014-02-04] (INCA Internet Co., Ltd.)

S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)

S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [126976 2012-07-25] (Microsoft Corporation) [File not signed]

S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [759192 2013-09-03] (Tunngle.net GmbH) [File not signed]

R2 USBS3S4Detection; C:\OEM\USBDECTION\USBS3S4Detection.exe [76320 2009-12-09] ()
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-30] (Avira Operations GmbH & Co. KG)

S3 NPPTNT2; C:\Windows\SysWOW64\npptNT2.sys [4682 2005-01-02] (INCA Internet Co., Ltd.) [File not signed]

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-02-15] (Apple, Inc.) [File not signed]

S3 VSPerfDrv110; C:\Program Files (x86)\Microsoft Visual Studio 11.0\Team Tools\Performance Tools\x64\VSPerfDrv110.sys [70264 2012-07-26] (Microsoft Corporation)

S3 ALSysIO; \??\C:\Users\Ukulele\AppData\Local\Temp\ALSysIO64.sys [X]

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-18 00:10 - 2014-08-18 00:10 - 00000837 _____ () C:\Users\Ukulele\Desktop\checkup.txt

2014-08-18 00:05 - 2014-08-18 00:05 - 00854417 _____ () C:\Users\Ukulele\Desktop\SecurityCheck.exe

2014-08-17 10:26 - 2014-08-17 10:26 - 02347384 _____ (ESET) C:\Users\Ukulele\Desktop\esetsmartinstaller_deu.exe

2014-08-16 12:26 - 2014-08-16 12:29 - 00052807 _____ () C:\Users\Ukulele\Desktop\FRST2.txt

2014-08-16 12:23 - 2014-08-18 00:11 - 00000000 ____D () C:\Users\Ukulele\Desktop\FRST-OlderVersion

2014-08-16 12:19 - 2014-08-16 12:28 - 00001251 _____ () C:\Users\Ukulele\Desktop\JRT.txt

2014-08-16 12:14 - 2014-08-16 12:14 - 00000000 ____D () C:\Windows\ERUNT

2014-08-16 12:13 - 2014-08-16 12:13 - 01016261 _____ (Thisisu) C:\Users\Ukulele\Desktop\JRT.exe

2014-08-16 12:11 - 2014-08-16 12:27 - 00019787 _____ () C:\Users\Ukulele\Desktop\AdwCleaner[S0].txt

2014-08-16 12:02 - 2014-08-16 12:06 - 00000000 ____D () C:\AdwCleaner

2014-08-16 12:01 - 2014-08-16 12:27 - 00058924 _____ () C:\Users\Ukulele\Desktop\mbam.txt

2014-08-16 12:01 - 2014-08-16 12:01 - 01361203 _____ () C:\Users\Ukulele\Desktop\adwcleaner_3.306.exe

2014-08-16 11:38 - 2014-08-16 11:59 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-16 11:37 - 2014-08-16 11:37 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-16 11:37 - 2014-08-16 11:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-16 11:37 - 2014-08-16 11:37 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-16 11:37 - 2014-08-16 11:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-16 11:37 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-08-16 11:37 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-08-16 11:37 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-08-16 11:36 - 2014-08-16 11:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Ukulele\Desktop\mbam-setup-2.0.2.1012.exe

2014-08-15 09:33 - 2014-08-15 09:33 - 00026728 _____ () C:\ComboFix.txt

2014-08-15 09:10 - 2014-08-15 09:33 - 00000000 ____D () C:\Qoobox

2014-08-15 09:10 - 2014-08-15 09:32 - 00000000 ____D () C:\Windows\erdnt

2014-08-15 09:10 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-08-15 09:10 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-08-15 09:10 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-08-15 09:10 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-08-15 09:10 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-08-15 09:10 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-08-15 09:10 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-08-15 09:10 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-08-15 09:08 - 2014-08-15 09:09 - 05571320 ____R (Swearware) C:\Users\Ukulele\Desktop\ComboFix.exe

2014-08-15 00:05 - 2014-08-15 00:05 - 00021570 _____ () C:\Users\Ukulele\Desktop\254991506_interesting_xlarge.jpeg

2014-08-14 15:53 - 2014-08-14 15:53 - 00455824 _____ () C:\Windows\Minidump\081414-40061-01.dmp

2014-08-14 12:57 - 2014-08-14 13:32 - 00003829 _____ () C:\Users\Ukulele\Desktop\Gmer.txt

2014-08-14 12:32 - 2014-08-14 12:32 - 00380416 _____ () C:\Users\Ukulele\Desktop\ym26j88u.exe

2014-08-14 11:49 - 2014-08-14 11:49 - 00005826 _____ () C:\Users\Ukulele\Documents\Ereignisse.txt

2014-08-14 11:37 - 2014-08-14 11:47 - 00062086 _____ () C:\Users\Ukulele\Desktop\Addition.txt

2014-08-14 11:36 - 2014-08-18 00:11 - 00015403 _____ () C:\Users\Ukulele\Desktop\FRST.txt

2014-08-14 11:35 - 2014-08-18 00:11 - 02101760 _____ (Farbar) C:\Users\Ukulele\Desktop\FRST64.exe

2014-08-14 11:35 - 2014-08-18 00:11 - 00000000 ____D () C:\FRST

2014-08-14 11:34 - 2014-08-14 12:32 - 00000478 _____ () C:\Users\Ukulele\Desktop\defogger_disable.log

2014-08-14 11:34 - 2014-08-14 11:34 - 00050477 _____ () C:\Users\Ukulele\Desktop\Defogger.exe

2014-08-14 11:34 - 2014-08-14 11:34 - 00000000 _____ () C:\Users\Ukulele\defogger_reenable

2014-08-14 00:39 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll

2014-08-14 00:39 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll

2014-08-14 00:39 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe

2014-08-14 00:39 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll

2014-08-14 00:39 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe

2014-08-14 00:39 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll

2014-08-14 00:38 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe

2014-08-14 00:38 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe

2014-08-13 11:42 - 2014-08-13 11:42 - 00001167 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-08-13 11:33 - 2014-08-13 11:33 - 00013189 _____ () C:\Users\Ukulele\Desktop\bookmarks-2014-08-13.json

2014-08-13 11:31 - 2014-08-13 11:31 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\dlg

2014-08-13 11:28 - 2014-08-16 07:02 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\Apps\2.0

2014-08-13 11:28 - 2014-08-15 08:01 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\Deployment

2014-08-13 11:05 - 2014-08-13 11:05 - 00000000 ____D () C:\Users\Ukulele\Desktop\musik

2014-08-13 09:36 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-13 09:36 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-08-13 09:36 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-08-13 09:36 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-08-13 09:36 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-08-13 09:36 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-08-13 09:36 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-08-13 09:36 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-08-13 09:36 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-08-13 09:36 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-08-13 09:36 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-08-13 09:36 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-08-13 09:36 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-08-13 09:36 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-08-13 09:36 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-08-13 09:36 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-08-13 09:36 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-08-13 09:36 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-08-13 09:36 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-08-13 09:36 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-08-13 09:36 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-08-13 09:36 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-08-13 09:36 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-08-13 09:36 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-08-13 09:36 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-08-13 09:36 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-08-13 09:36 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-08-13 09:36 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-08-13 09:36 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-08-13 09:36 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-08-13 09:36 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-08-13 09:36 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-08-13 09:36 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-08-13 09:36 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-08-13 09:36 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-08-13 09:36 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-08-13 09:36 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-08-13 09:36 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-08-13 09:36 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-08-13 09:36 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-08-13 09:36 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-08-13 09:36 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-08-13 09:36 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-08-13 09:36 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-08-13 09:36 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-08-13 09:36 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-08-13 09:36 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-08-13 09:36 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-08-13 09:36 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-08-13 09:36 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-08-13 09:36 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-08-13 09:36 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-08-13 09:36 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-08-13 09:36 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-08-13 09:36 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-08-13 09:36 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-08-13 09:36 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-08-13 09:36 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-08-13 09:36 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-08-13 09:36 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2014-08-13 09:36 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-08-13 09:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL

2014-08-13 09:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL

2014-08-13 09:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL

2014-08-13 09:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL

2014-08-13 09:36 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL

2014-08-13 09:36 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL

2014-08-13 09:36 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls

2014-08-13 09:36 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls

2014-08-13 09:36 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-08-13 09:36 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-08-13 09:36 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2014-08-13 09:36 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-08-13 09:36 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-08-13 09:36 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll

2014-08-13 09:36 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe

2014-08-13 09:36 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-08-13 09:36 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-08-13 09:36 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll

2014-08-13 09:33 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-08-13 09:33 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-08-13 09:33 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2014-08-13 09:33 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2014-08-10 23:55 - 2014-08-10 23:55 - 00000050 _____ () C:\Users\Ukulele\Desktop\asd.txt

2014-08-09 23:13 - 2014-08-11 17:57 - 00053474 _____ () C:\Users\Ukulele\Desktop\Guantanamo_NEW.odt

2014-08-09 18:59 - 2014-08-09 19:00 - 00275344 _____ () C:\Windows\Minidump\080914-20264-01.dmp

2014-08-07 22:17 - 2014-08-07 22:17 - 00275344 _____ () C:\Windows\Minidump\080714-21200-01.dmp

2014-08-06 08:25 - 2014-08-06 08:25 - 00275344 _____ () C:\Windows\Minidump\080614-26130-01.dmp

2014-08-05 00:47 - 2014-08-05 00:47 - 00001237 _____ () C:\Users\Public\Desktop\ElsterFormular.lnk

2014-08-05 00:47 - 2014-08-05 00:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular

2014-08-05 00:46 - 2014-08-05 00:46 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular

2014-08-05 00:39 - 2014-08-05 00:45 - 77405552 _____ (Landesfinanzdirektion Thüringen) C:\Users\Ukulele\Desktop\ElsterFormular-15.2.20140326p.exe

2014-08-02 21:37 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-08-02 21:37 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-08-02 21:37 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-08-02 21:37 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-08-02 21:37 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-08-02 21:37 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-08-02 21:36 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-08-02 21:36 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-08-02 21:36 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-08-02 21:36 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-08-02 10:05 - 2014-08-02 10:05 - 00275344 _____ () C:\Windows\Minidump\080214-30622-01.dmp

2014-08-01 16:17 - 2014-08-01 16:17 - 00000000 ____D () C:\Users\Ukulele\Desktop\MOFUGG xD

2014-08-01 16:16 - 2014-08-01 16:16 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\TeamViewer

2014-08-01 12:04 - 2014-08-01 12:04 - 00000000 __SHD () C:\Users\Ukulele\AppData\Local\EmieUserList

2014-08-01 12:04 - 2014-08-01 12:04 - 00000000 __SHD () C:\Users\Ukulele\AppData\Local\EmieSiteList

2014-08-01 11:27 - 2014-08-01 11:27 - 00000000 ____D () C:\gravity

2014-08-01 11:22 - 2014-08-01 11:22 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-08-01 11:22 - 2014-08-01 11:22 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-07-30 02:01 - 2014-08-13 11:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-07-29 10:49 - 2014-07-29 10:49 - 00275344 _____ () C:\Windows\Minidump\072914-24632-01.dmp

2014-07-27 10:13 - 2014-07-27 10:13 - 00275344 _____ () C:\Windows\Minidump\072714-26223-01.dmp

2014-07-27 03:35 - 2014-07-27 03:35 - 00006736 _____ () C:\Users\Ukulele\Desktop\Stellenausschreibung.htm

2014-07-27 03:35 - 2014-07-27 03:35 - 00000000 ____D () C:\Users\Ukulele\Desktop\Stellenausschreibung-Dateien

2014-07-26 03:03 - 2014-07-26 03:03 - 00000000 ____D () C:\ProgramData\VS

2014-07-23 09:41 - 2014-07-23 09:41 - 00262144 ____N () C:\Windows\Minidump\072314-25443-01.dmp

2014-07-19 12:31 - 2014-07-19 13:08 - 00020844 _____ () C:\Users\Ukulele\Desktop\Buchhaltung Nachhilfe 2014.ods
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-18 00:13 - 2012-12-26 19:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-08-18 00:12 - 2014-08-14 11:36 - 00015403 _____ () C:\Users\Ukulele\Desktop\FRST.txt

2014-08-18 00:11 - 2014-08-16 12:23 - 00000000 ____D () C:\Users\Ukulele\Desktop\FRST-OlderVersion

2014-08-18 00:11 - 2014-08-14 11:35 - 02101760 _____ (Farbar) C:\Users\Ukulele\Desktop\FRST64.exe

2014-08-18 00:11 - 2014-08-14 11:35 - 00000000 ____D () C:\FRST

2014-08-18 00:10 - 2014-08-18 00:10 - 00000837 _____ () C:\Users\Ukulele\Desktop\checkup.txt

2014-08-18 00:05 - 2014-08-18 00:05 - 00854417 _____ () C:\Users\Ukulele\Desktop\SecurityCheck.exe

2014-08-17 22:55 - 2007-10-10 13:04 - 01657056 _____ () C:\Windows\WindowsUpdate.log

2014-08-17 13:48 - 2011-01-11 05:44 - 00000000 ____D () C:\Program Files (x86)\KaloMa

2014-08-17 13:46 - 2009-07-14 07:13 - 01836146 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-08-17 13:46 - 2007-10-10 22:56 - 00776056 _____ () C:\Windows\system32\perfh007.dat

2014-08-17 13:46 - 2007-10-10 22:56 - 00179582 _____ () C:\Windows\system32\perfc007.dat

2014-08-17 12:41 - 2009-07-14 06:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-08-17 12:41 - 2009-07-14 06:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-08-17 10:28 - 2010-11-01 20:36 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\Skype

2014-08-17 10:27 - 2013-02-05 00:36 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-08-17 10:26 - 2014-08-17 10:26 - 02347384 _____ (ESET) C:\Users\Ukulele\Desktop\esetsmartinstaller_deu.exe

2014-08-17 10:24 - 2009-07-14 06:51 - 00755557 _____ () C:\Windows\setupact.log

2014-08-17 10:23 - 2014-07-08 13:53 - 00000000 ___RD () C:\Users\Ukulele\Desktop\MASTERPLAN!

2014-08-17 07:32 - 2009-07-14 06:45 - 00368912 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-08-17 07:31 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-08-16 12:29 - 2014-08-16 12:26 - 00052807 _____ () C:\Users\Ukulele\Desktop\FRST2.txt

2014-08-16 12:28 - 2014-08-16 12:19 - 00001251 _____ () C:\Users\Ukulele\Desktop\JRT.txt

2014-08-16 12:27 - 2014-08-16 12:11 - 00019787 _____ () C:\Users\Ukulele\Desktop\AdwCleaner[S0].txt

2014-08-16 12:27 - 2014-08-16 12:01 - 00058924 _____ () C:\Users\Ukulele\Desktop\mbam.txt

2014-08-16 12:14 - 2014-08-16 12:14 - 00000000 ____D () C:\Windows\ERUNT

2014-08-16 12:13 - 2014-08-16 12:13 - 01016261 _____ (Thisisu) C:\Users\Ukulele\Desktop\JRT.exe

2014-08-16 12:07 - 2009-11-26 19:58 - 01176326 _____ () C:\Windows\PFRO.log

2014-08-16 12:06 - 2014-08-16 12:02 - 00000000 ____D () C:\AdwCleaner

2014-08-16 12:01 - 2014-08-16 12:01 - 01361203 _____ () C:\Users\Ukulele\Desktop\adwcleaner_3.306.exe

2014-08-16 11:59 - 2014-08-16 11:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-16 11:37 - 2014-08-16 11:37 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-16 11:37 - 2014-08-16 11:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-16 11:37 - 2014-08-16 11:37 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-16 11:37 - 2014-08-16 11:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-16 11:37 - 2014-08-16 11:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Ukulele\Desktop\mbam-setup-2.0.2.1012.exe

2014-08-16 11:32 - 2013-08-05 01:58 - 00000247 _____ () C:\Users\Ukulele\AppData\Roaming\WB.CFG

2014-08-16 07:02 - 2014-08-13 11:28 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\Apps\2.0

2014-08-15 09:33 - 2014-08-15 09:33 - 00026728 _____ () C:\ComboFix.txt

2014-08-15 09:33 - 2014-08-15 09:10 - 00000000 ____D () C:\Qoobox

2014-08-15 09:33 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-08-15 09:32 - 2014-08-15 09:10 - 00000000 ____D () C:\Windows\erdnt

2014-08-15 09:28 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-08-15 09:09 - 2014-08-15 09:08 - 05571320 ____R (Swearware) C:\Users\Ukulele\Desktop\ComboFix.exe

2014-08-15 08:01 - 2014-08-13 11:28 - 00000000 ____D () C:\Users\Ukulele\AppData\Local\Deployment

2014-08-15 00:05 - 2014-08-15 00:05 - 00021570 _____ () C:\Users\Ukulele\Desktop\254991506_interesting_xlarge.jpeg

2014-08-14 16:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-08-14 15:53 - 2014-08-14 15:53 - 00455824 _____ () C:\Windows\Minidump\081414-40061-01.dmp

2014-08-14 15:53 - 2011-02-11 13:31 - 823211026 _____ () C:\Windows\MEMORY.DMP

2014-08-14 15:53 - 2011-02-11 13:31 - 00000000 ____D () C:\Windows\Minidump

2014-08-14 13:32 - 2014-08-14 12:57 - 00003829 _____ () C:\Users\Ukulele\Desktop\Gmer.txt

2014-08-14 12:32 - 2014-08-14 12:32 - 00380416 _____ () C:\Users\Ukulele\Desktop\ym26j88u.exe

2014-08-14 12:32 - 2014-08-14 11:34 - 00000478 _____ () C:\Users\Ukulele\Desktop\defogger_disable.log

2014-08-14 11:49 - 2014-08-14 11:49 - 00005826 _____ () C:\Users\Ukulele\Documents\Ereignisse.txt

2014-08-14 11:47 - 2014-08-14 11:37 - 00062086 _____ () C:\Users\Ukulele\Desktop\Addition.txt

2014-08-14 11:34 - 2014-08-14 11:34 - 00050477 _____ () C:\Users\Ukulele\Desktop\Defogger.exe

2014-08-14 11:34 - 2014-08-14 11:34 - 00000000 _____ () C:\Users\Ukulele\defogger_reenable

2014-08-14 11:34 - 2010-10-21 15:39 - 00000000 ____D () C:\Users\Ukulele

2014-08-14 06:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-08-14 00:57 - 2009-11-26 19:39 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-08-14 00:50 - 2013-08-07 03:00 - 00000000 ____D () C:\Windows\system32\MRT

2014-08-14 00:46 - 2010-10-24 13:53 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-08-14 00:38 - 2014-05-07 00:21 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-08-13 19:01 - 2012-09-25 08:18 - 00000000 ____D () C:\Program Files (x86)\Freetec

2014-08-13 19:01 - 2012-09-25 08:17 - 00000000 ____D () C:\ProgramData\Package Cache

2014-08-13 12:01 - 2012-08-19 05:59 - 00000000 ____D () C:\Users\Ukulele\Documents\TubeBox

2014-08-13 11:42 - 2014-08-13 11:42 - 00001167 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-08-13 11:42 - 2014-07-30 02:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-08-13 11:42 - 2012-05-23 22:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-08-13 11:40 - 2013-10-01 20:46 - 00000000 ____D () C:\Program Files (x86)\Athan

2014-08-13 11:35 - 2013-08-21 02:03 - 00000000 ____D () C:\Program Files (x86)\Audacity

2014-08-13 11:33 - 2014-08-13 11:33 - 00013189 _____ () C:\Users\Ukulele\Desktop\bookmarks-2014-08-13.json

2014-08-13 11:31 - 2014-08-13 11:31 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\dlg

2014-08-13 11:27 - 2009-11-26 19:47 - 00000000 ____D () C:\Program Files (x86)\Google

2014-08-13 11:05 - 2014-08-13 11:05 - 00000000 ____D () C:\Users\Ukulele\Desktop\musik

2014-08-11 17:57 - 2014-08-09 23:13 - 00053474 _____ () C:\Users\Ukulele\Desktop\Guantanamo_NEW.odt

2014-08-10 23:55 - 2014-08-10 23:55 - 00000050 _____ () C:\Users\Ukulele\Desktop\asd.txt

2014-08-10 09:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-08-09 19:00 - 2014-08-09 18:59 - 00275344 _____ () C:\Windows\Minidump\080914-20264-01.dmp

2014-08-07 22:17 - 2014-08-07 22:17 - 00275344 _____ () C:\Windows\Minidump\080714-21200-01.dmp

2014-08-07 08:01 - 2010-11-01 20:36 - 00000000 ____D () C:\ProgramData\Skype

2014-08-07 04:06 - 2014-08-13 09:33 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-08-07 04:01 - 2014-08-13 09:33 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-08-06 08:25 - 2014-08-06 08:25 - 00275344 _____ () C:\Windows\Minidump\080614-26130-01.dmp

2014-08-05 00:48 - 2012-05-30 22:07 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\elsterformular

2014-08-05 00:47 - 2014-08-05 00:47 - 00001237 _____ () C:\Users\Public\Desktop\ElsterFormular.lnk

2014-08-05 00:47 - 2014-08-05 00:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular

2014-08-05 00:46 - 2014-08-05 00:46 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular

2014-08-05 00:46 - 2012-05-30 22:06 - 00000000 ____D () C:\ProgramData\elsterformular

2014-08-05 00:45 - 2014-08-05 00:39 - 77405552 _____ (Landesfinanzdirektion Thüringen) C:\Users\Ukulele\Desktop\ElsterFormular-15.2.20140326p.exe

2014-08-04 00:51 - 2013-10-18 21:09 - 00000000 ____D () C:\ProgramData\Tunngle

2014-08-04 00:51 - 2010-11-01 20:52 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\Tunngle

2014-08-02 10:05 - 2014-08-02 10:05 - 00275344 _____ () C:\Windows\Minidump\080214-30622-01.dmp

2014-08-01 16:17 - 2014-08-01 16:17 - 00000000 ____D () C:\Users\Ukulele\Desktop\MOFUGG xD

2014-08-01 16:16 - 2014-08-01 16:16 - 00000000 ____D () C:\Users\Ukulele\AppData\Roaming\TeamViewer

2014-08-01 12:04 - 2014-08-01 12:04 - 00000000 __SHD () C:\Users\Ukulele\AppData\Local\EmieUserList

2014-08-01 12:04 - 2014-08-01 12:04 - 00000000 __SHD () C:\Users\Ukulele\AppData\Local\EmieSiteList

2014-08-01 11:27 - 2014-08-01 11:27 - 00000000 ____D () C:\gravity

2014-08-01 11:22 - 2014-08-01 11:22 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-08-01 11:22 - 2014-08-01 11:22 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-08-01 01:41 - 2014-08-13 09:36 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-01 01:16 - 2014-08-13 09:36 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-07-29 10:49 - 2014-07-29 10:49 - 00275344 _____ () C:\Windows\Minidump\072914-24632-01.dmp

2014-07-27 10:13 - 2014-07-27 10:13 - 00275344 _____ () C:\Windows\Minidump\072714-26223-01.dmp

2014-07-27 03:35 - 2014-07-27 03:35 - 00006736 _____ () C:\Users\Ukulele\Desktop\Stellenausschreibung.htm

2014-07-27 03:35 - 2014-07-27 03:35 - 00000000 ____D () C:\Users\Ukulele\Desktop\Stellenausschreibung-Dateien

2014-07-27 02:54 - 2013-11-30 20:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2010 Express

2014-07-26 03:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared

2014-07-26 03:04 - 2013-10-08 08:25 - 00085888 _____ () C:\Users\Default\AppData\Local\GDIPFONTCACHEV1.DAT

2014-07-26 03:04 - 2013-10-08 08:25 - 00085888 _____ () C:\Users\Default User\AppData\Local\GDIPFONTCACHEV1.DAT

2014-07-26 03:03 - 2014-07-26 03:03 - 00000000 ____D () C:\ProgramData\VS

2014-07-25 16:52 - 2014-08-13 09:36 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-07-25 16:02 - 2014-08-13 09:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-07-25 16:01 - 2014-08-13 09:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-07-25 15:51 - 2014-08-13 09:36 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-07-25 15:30 - 2014-08-13 09:36 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-07-25 15:28 - 2014-08-13 09:36 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-07-25 15:28 - 2014-08-13 09:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-07-25 15:25 - 2014-08-13 09:36 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-07-25 15:25 - 2014-08-13 09:36 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-07-25 15:11 - 2014-08-13 09:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-07-25 15:10 - 2014-08-13 09:36 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-07-25 15:04 - 2014-08-13 09:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-07-25 15:03 - 2014-08-13 09:36 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-07-25 15:00 - 2014-08-13 09:36 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-07-25 15:00 - 2014-08-13 09:36 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-07-25 14:59 - 2014-08-13 09:36 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-07-25 14:47 - 2014-08-13 09:36 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-07-25 14:40 - 2014-08-13 09:36 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-07-25 14:34 - 2014-08-13 09:36 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-07-25 14:34 - 2014-08-13 09:36 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-07-25 14:33 - 2014-08-13 09:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-07-25 14:30 - 2014-08-13 09:36 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-07-25 14:28 - 2014-08-13 09:36 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-07-25 14:28 - 2014-08-13 09:36 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-07-25 14:21 - 2014-08-13 09:36 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-07-25 14:19 - 2014-08-13 09:36 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-07-25 14:18 - 2014-08-13 09:36 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-07-25 14:17 - 2014-08-13 09:36 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-07-25 14:17 - 2014-08-13 09:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-07-25 14:12 - 2014-08-13 09:36 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-07-25 14:10 - 2014-08-13 09:36 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-07-25 14:10 - 2014-08-13 09:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-07-25 14:08 - 2014-08-13 09:36 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-07-25 14:06 - 2014-08-13 09:36 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-07-25 13:52 - 2014-08-13 09:36 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-07-25 13:47 - 2014-08-13 09:36 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-07-25 13:43 - 2014-08-13 09:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-07-25 13:42 - 2014-08-13 09:36 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-07-25 13:39 - 2014-08-13 09:36 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-07-25 13:39 - 2014-08-13 09:36 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-07-25 13:36 - 2014-08-13 09:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-07-25 13:34 - 2014-08-13 09:36 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-07-25 13:29 - 2014-08-13 09:36 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-07-25 13:23 - 2014-08-13 09:36 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-07-25 13:13 - 2014-08-13 09:36 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-07-25 13:07 - 2014-08-13 09:36 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-07-25 13:07 - 2014-08-13 09:36 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-07-25 13:03 - 2014-08-13 09:36 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-07-25 12:52 - 2014-08-13 09:36 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-07-25 12:26 - 2014-08-13 09:36 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-07-25 12:17 - 2014-08-13 09:36 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-07-25 12:09 - 2014-08-13 09:36 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-07-25 12:05 - 2014-08-13 09:36 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-07-25 12:00 - 2014-08-13 09:36 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-07-24 21:45 - 2013-07-27 17:22 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-07-24 10:30 - 2012-05-14 10:45 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-07-24 10:30 - 2012-05-14 10:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-07-24 03:02 - 2012-05-14 10:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2014-07-23 09:41 - 2014-07-23 09:41 - 00262144 ____N () C:\Windows\Minidump\072314-25443-01.dmp

2014-07-20 21:47 - 2010-11-01 19:33 - 00000000 ____D () C:\Users\Ukulele\Documents\My Games

2014-07-19 13:08 - 2014-07-19 12:31 - 00020844 _____ () C:\Users\Ukulele\Desktop\Buchhaltung Nachhilfe 2014.ods
 

Some content of TEMP:

====================

C:\Users\Ukulele\AppData\Local\Temp\avgnt.exe

C:\Users\Ukulele\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-08-08 15:51
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Java udpaten. DIe Mülldeponie auf D entrümpeln ;)

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.