Hallo Schrauber,
Die mbam.txt ist leer. Keine Ahnung, was ich falsch gemacht habe. Code:
# AdwCleaner v4.101 - Bericht erstellt am 12/11/2014 um 20:23:49
# Aktualisiert 09/11/2014 von Xplode
# Database : 2014-11-12.2 [Live]
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Max Mengelberg - CAD4
# Gestartet von : C:\Users\Max Mengelberg\Desktop\AdwCleaner_4.101.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\Program Files (x86)\Common Files\Tobit
Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Users\Max Mengelberg\AppData\Local\AskToolbar
Ordner Gelöscht : C:\Users\Max Mengelberg\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Max Mengelberg\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\Max Mengelberg\AppData\Roaming\Tobit
Ordner Gelöscht : C:\Users\Max Mengelberg\AppData\Roaming\DriverTurbo
Ordner Gelöscht : C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\Extensions\sparpilot@sparpilot.com
Ordner Gelöscht : C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\Extensions\toolbar@ask.com
Datei Gelöscht : C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\invalidprefs.js
Datei Gelöscht : C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\searchplugins\askcomsearch.xml
Datei Gelöscht : C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\searchplugins\ask-search.xml
Datei Gelöscht : C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\user.js
***** [ Tasks ] *****
Task Gelöscht : Scheduled Update for Ask Toolbar
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{065C1A21-97F8-45FB-A9F0-861B60FACEC8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3204358F-5904-46A6-841F-D6B5BE3EF4E3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3AE67737-0E3E-44AA-AA5E-46A68BF017FF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3EE5B726-044A-48D2-AA7B-049BD9A0F62A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{60FBBE03-57FF-49D8-B38E-053D3F489825}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6A5182F1-C0B8-42B8-96CC-7F329CD46913}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6C153418-8E4D-4FAF-AF27-5201E38463A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A26A2F05-AC4D-4A1E-9531-9125F7309B78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC5D6240-7DF0-435D-9B9B-F8586A99DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F343045E-E20A-46E1-82D8-9962C43EFC9E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FBB360DC-CB6C-4D6A-808A-2C773151BFFF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFD7DDAC-EC28-42A5-8D39-917B9078604B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{F63A9EB9-6C59-4C4E-8AEA-6594ED04EF11}
Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\APN
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\apnwidgets.ask.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17344
-\\ Mozilla Firefox v32.0.3 (x86 de)
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.defaultengine", "Ask.com Search");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.defaultenginename", "Ask.com Search");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.order.1", "Ask.com Search");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.selectedEngine", "Ask.com Search");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.AviraIDW-TS", "1319885630412");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.AviraIDW-XML", "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<button xmlns=\"hxxp://websearch.ask.com/widgets\">\n <widget_url>hxxps://aviratoolbar.idwatchdog.com/toolbar[...]
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.InstallDir", "C:\\Program Files (x86)\\Ask.com\\");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.OOBEVersion", "1");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.autofill-text-highlight-enabled", true);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.cbid", "LL");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.config-updated", false);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.crumb", "2011.10.07+11.11.04-toolbar003iad-DE-Q29sb2duZSxHZXJtYW55");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://de.ask.com/web?q={query}&qsrc={qsrc}&o={o}&l={l}&gct=bar");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.dtid", "YYYYYYYYDE");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.first-launch-url", "hxxp://picasa-readme.blogspot.com/");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.first-restart-after-config-update", true);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.fresh-install", false);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.guid", "1bb34d7f-a1f9-4890-94c2-5db083edefed");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.hxxp-header-whitelist-hosts", "[\"static-dev.en.dev.ask.com\", \"ask.com\", \"www.facebook.com\", \"www.playsushi.com\", \"WWW.google.com\", \"hxxps://websearch.ask.com\", [...]
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.if", "first");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.keyword-toggled-in-session", false);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.l", "dis");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.last-config-req", "1402653905818");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.last-search-timestamp", "1397985903162");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.locale", "de_DE");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.location", "Cologne,Germany");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.new-tab-opt-out", true);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.notification-shown", true);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.o", "APN10023");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.qsrc", "2871");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.r", "2");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.sa", "YES");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.saguid", "C4FBD2B9-1190-40A3-B230-3589D18FFA34");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.search-history-queries", "ganterhirth-ringzeichnungsvordrucke solidworkswo zeichnungsvordrucke solidworkswo finde ich zeichnungsvordrucke solidworksThe Oxwagon Ri[...]
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.search-suggestions-enabled", true);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.silent-upgrade", true);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.silent-upgrade-from-pre-newtabs-build", false);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.socialmini-native-on", true);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.themeid", "");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.timeinstalled", "13.06.2012 13:19:09");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.to", "");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.v", "3.15.31.100015");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.version", "5.15.31.57710");
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.toolbar@ask.com.install-event-fired", true);
[kil6doe5.default\prefs.js] - Zeile gelöscht : user_pref("extensions.toolbar_ORJ-V7C@apn.ask.com.install-event-fired", true);
-\\ Google Chrome v38.0.2125.111
*************************
AdwCleaner[R0].txt - [14677 octets] - [12/11/2014 20:14:04]
AdwCleaner[R1].txt - [14738 octets] - [12/11/2014 20:21:29]
AdwCleaner[S0].txt - [14659 octets] - [12/11/2014 20:23:49]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14720 octets] ########## Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.7 (11.08.2014:1)
OS: Windows 7 Professional x64
Ran by Max Mengelberg on 12.11.2014 at 20:42:07,97
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] "hkey_current_user\software\classes\typelib\{006ad7b2-968a-11de-88c9-5bde55d89593}"
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9"
~~~ Files
~~~ Folders
~~~ FireFox
Successfully deleted: [File] C:\Users\Max Mengelberg\AppData\Roaming\mozilla\firefox\profiles\kil6doe5.default\searchplugins\avira-safesearch.xml
Successfully deleted: [Folder] C:\Users\Max Mengelberg\AppData\Roaming\mozilla\firefox\profiles\kil6doe5.default\extensions\safesearch@avira.com
Successfully deleted: [Folder] C:\Users\Max Mengelberg\AppData\Roaming\mozilla\firefox\profiles\kil6doe5.default\extensions\toolbar@web.de
Successfully deleted the following from C:\Users\Max Mengelberg\AppData\Roaming\mozilla\firefox\profiles\kil6doe5.default\prefs.js
user_pref("avira.safe_search.search_was_active", "false");
user_pref("extensions.bootstrappedAddons", "{\"elemhidehelper@adblockplus.org\":{\"version\":\"1.3\",\"type\":\"extension\",\"descriptor\":\"C:\\\\Users\\\\Max Mengelberg\\\\A
user_pref("extensions.safesearch.MP_DISTINCT_ID", "\"147a5092931e7-0f581d9a9c989b-42504136-0-147a5092932326\"");
user_pref("extensions.safesearch.SAUTH_expires_at", "1415988538");
user_pref("extensions.safesearch.SAUTH_rndsnr", "\"7061afea2c968de632323805d3fe3bfc8116a6a7\"");
user_pref("extensions.safesearch.SAUTH_userid", "4292691168");
user_pref("extensions.safesearch.SAUTH_utoken", "\"a4e1a7c07cf284570a893b85ea46d386ef3fd096\"");
user_pref("extensions.safesearch.install", "1407223146806");
user_pref("extensions.safesearch@avira.com.install-event-fired", true);
Emptied folder: C:\Users\Max Mengelberg\AppData\Roaming\mozilla\firefox\profiles\kil6doe5.default\minidumps [84 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.11.2014 at 20:45:36,26
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-11-2014 01
Ran by Max Mengelberg (administrator) on CAD4 on 12-11-2014 20:59:41
Running from C:\Users\Max Mengelberg\Desktop
Loaded Profile: Max Mengelberg (Available profiles: Max Mengelberg)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvwmi64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvwmi64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\ZCfgSvc7.exe
(UPEK Inc.) C:\Program Files\Common Files\SPBA\upeksvr.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe
(Dell Computer Corporation) C:\dell\DBRM\Reminder\DbrmTrayicon.exe
(Tobit.Software) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Dell Inc.) C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
() C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
(ACD Systems, Ltd.) C:\Program Files (x86)\Common Files\ACD Systems\DE\DevDetect.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Apple Inc.) C:\Program Files (x86)\QuickTime\QTTask.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Dell Inc.) C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Dassault Systèmes SolidWorks Corp.) C:\Program Files\SolidWorks Corp\SolidWorks (3)\sldworks_fs.exe
(Dassault Systèmes SolidWorks Corp.) C:\Program Files\SolidWorks Corp\SolidWorks (4)\sldworks_fs.exe
(Dassault Systèmes SolidWorks Corp.) C:\Program Files (x86)\Common Files\SolidWorks Installations-Manager\BackgroundDownloading\sldBgDwld.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\NASNAVI\NasNavi.exe
(Dropbox, Inc.) C:\Users\Max Mengelberg\AppData\Roaming\Dropbox\bin\Dropbox.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\NASNAVI\nassche.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Dassault Systèmes SolidWorks Corp.) C:\Program Files\SolidWorks Corp\SolidWorks (3)\swScheduler\swBOEngine.exe
(Dell Inc.) C:\Program Files\Dell\Dell System Manager\PanelHelper32.exe
(O2Micro International) C:\Windows\System32\drivers\o2flash.exe
() C:\Windows\SysWOW64\srvany.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(O2Micro.) C:\Windows\SysWOW64\SDIOAssist.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [608112 2011-04-05] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-07] (IDT, Inc.)
HKLM\...\Run: [IntelPROSet] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1934608 2010-12-23] (Intel(R) Corporation)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2011-04-22] ()
HKLM\...\Run: [TdmNotify] => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe [257392 2011-05-27] (Wave Systems Corp.)
HKLM\...\Run: [DBRMTray] => C:\Dell\DBRM\Reminder\DbrmTrayIcon.exe [227328 2011-03-08] (Dell Computer Corporation)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2747680 2013-12-04] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-17] (Intel Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [462993 2010-03-12] (Creative Technology Ltd)
HKLM-x32\...\Run: [RemoteControl9] => C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2009-07-06] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-04-29] (CyberLink Corp.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
HKLM-x32\...\Run: [Device Detector] => DevDetect.exe -autorun
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124720 2014-10-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\spba: C:\Program Files\Common Files\SPBA\homefus2.dll (UPEK Inc.)
HKU\S-1-5-21-3300202761-1955330803-1272055055-1001\...\Run: [rfxsrvtray] => C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [184048 2013-12-04] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156256 2013-12-04] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Dell System Manager.lnk
ShortcutTarget: Dell System Manager.lnk -> C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe (Dell Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Radio.fx.LNK
ShortcutTarget: Radio.fx.LNK -> C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client.exe (Tobit.Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SolidWorks 2013 Schnellstart.lnk
ShortcutTarget: SolidWorks 2013 Schnellstart.lnk -> C:\Windows\Installer\{B6B5EA7E-B91F-443D-A958-B0062FB53804}\NewShortcut2_87EDF6C81D0A4B7B84F42FE0C6A9D608.exe (Flexera Software, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SolidWorks 2014 Schnellstart.lnk
ShortcutTarget: SolidWorks 2014 Schnellstart.lnk -> C:\Windows\Installer\{4FFA60C4-9A8B-4C9E-8265-2241B266304C}\NewShortcut2_87EDF6C81D0A4B7B84F42FE0C6A9D608.exe (Flexera Software LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SolidWorks Hintergrund-Downloader.lnk
ShortcutTarget: SolidWorks Hintergrund-Downloader.lnk -> C:\Program Files (x86)\Common Files\SolidWorks Installations-Manager\BackgroundDownloading\sldBgDwld.exe (Dassault Systèmes SolidWorks Corp.)
Startup: C:\Users\Max Mengelberg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BUFFALO NAS Navigator2.lnk
ShortcutTarget: BUFFALO NAS Navigator2.lnk -> C:\Program Files (x86)\BUFFALO\NASNAVI\NasNavi.exe (BUFFALO INC.)
Startup: C:\Users\Max Mengelberg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Max Mengelberg\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Max Mengelberg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NAS Scheduler.lnk
ShortcutTarget: NAS Scheduler.lnk -> C:\Program Files (x86)\BUFFALO\NASNAVI\nassche.exe (BUFFALO INC.)
Startup: C:\Users\Max Mengelberg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SolidWorks Taskplaner Modul.lnk
ShortcutTarget: SolidWorks Taskplaner Modul.lnk -> C:\Program Files\SolidWorks Corp\SolidWorks (3)\swScheduler\swBOEngine.exe (Dassault Systèmes SolidWorks Corp.)
ShellIconOverlayIdentifiers: [EnabledUnlockedFDEIconOverlay] -> {30D3C2AF-9709-4D05-9CF4-13335F3C1E4A} => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll (Wave Systems Corp.)
ShellIconOverlayIdentifiers: [UninitializedFdeIconOverlay] -> {CF08DA3E-C97D-4891-A66B-E39B28DD270F} => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll (Wave Systems Corp.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USREL/8
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKU\S-1-5-21-3300202761-1955330803-1272055055-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {4D4B8109-E280-4844-BB98-CEDFA9107175} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=foxysecurity
SearchScopes: HKCU - {4D4B8109-E280-4844-BB98-CEDFA9107175} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=foxysecurity
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin-x32: @canon.com/MycameraPlugin -> C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\Extensions\abs@avira.com [2014-10-10]
FF Extension: Amazon-Icon - C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\Extensions\amazon-icon@giga.de [2014-10-23]
FF Extension: ReminderFox - C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\Extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae} [2014-04-19]
FF Extension: Bitdefender QuickScan - C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2014-11-10]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\Extensions\adblockpopups@jessehakanen.net.xpi [2011-10-08]
FF Extension: Cliqz Beta - C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\Extensions\cliqz@cliqz.com.xpi [2014-10-08]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\Extensions\elemhidehelper@adblockplus.org.xpi [2012-02-11]
FF Extension: {90ee036b-00a5-4e72-a613-6a5a024926d1} - C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\Extensions\{90ee036b-00a5-4e72-a613-6a5a024926d1}.xpi [2014-11-10]
FF Extension: Adblock Plus - C:\Users\Max Mengelberg\AppData\Roaming\Mozilla\Firefox\Profiles\kil6doe5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-11-09]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-05-10]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-05-10]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-05-10]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-10-09]
Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.msn.com/?pc=BDT3&ocid=BDT3DHP"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.290.11) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U29) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (NPCIG.dll) - C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\Max Mengelberg\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Max Mengelberg\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-01-12]
CHR Extension: (Amazon) - C:\Users\Max Mengelberg\AppData\Local\Google\Chrome\User Data\Default\Extensions\caeaobpemokdfnidgaebncaooofnbfha [2014-10-30]
CHR Extension: (Google-Suche) - C:\Users\Max Mengelberg\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-01-12]
CHR Extension: (Avira Browser Safety) - C:\Users\Max Mengelberg\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-30]
CHR Extension: (Google Wallet) - C:\Users\Max Mengelberg\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-30]
CHR Extension: (Google Mail) - C:\Users\Max Mengelberg\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-01-12]
CHR HKLM-x32\...\Chrome\Extension: [caeaobpemokdfnidgaebncaooofnbfha] - C:\Users\Max Mengelberg\ChromeExtensions\caeaobpemokdfnidgaebncaooofnbfha\amazon-icon-fwde.crx [2014-10-23]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [162096 2014-10-09] (Avira Operations GmbH & Co. KG)
S3 CoordinatorServiceHost; C:\Program Files\SolidWorks Corp\SolidWorks (4)\swScheduler\DTSCoordinatorService.exe [76328 2014-06-12] (Dassault Systèmes SolidWorks Corp.)
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-23] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-23] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NVWMI; C:\Windows\system32\nvwmi64.exe [1290016 2013-12-04] (NVIDIA Corporation)
R2 O2SDIOAssist; c:\Windows\SysWOW64\srvany.exe [8192 2003-04-19] () [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
S3 SolidWorks Licensing Service; C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2011-10-08] (SolidWorks) [File not signed]
S2 tcsd_win32.exe; C:\Program Files (x86)\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1633280 2011-02-17] () [File not signed]
R2 Wave Authentication Manager Service; C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe [1600000 2011-07-01] (Wave Systems Corp.) [File not signed]
R2 ZcfgSvc7; C:\Program Files\Intel\WiFi\bin\ZCfgSvc7.exe [992256 2010-12-23] (Intel(R) Corporation) [File not signed]
S2 Disaster Recovery Imaging; "C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP Professional\DR\x64\drdiag.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
S3 GenericMount; C:\Windows\System32\DRIVERS\GenericMount.sys [54320 2009-09-21] (Symantec Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-12] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-04] (NVIDIA Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-05-02] (Corel Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U2 V2iMount; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-12 20:53 - 2014-11-12 20:53 - 00002072 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-11-12 20:53 - 2014-11-12 20:53 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Roaming\Avira
2014-11-12 20:52 - 2014-11-12 20:52 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-11-12 20:52 - 2014-10-23 14:02 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-11-12 20:52 - 2014-10-23 14:02 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-11-12 20:52 - 2014-10-23 14:01 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-11-12 20:45 - 2014-11-12 20:45 - 00002573 _____ () C:\Users\Max Mengelberg\Desktop\JRT.txt
2014-11-12 20:42 - 2014-11-12 20:42 - 00000000 ____D () C:\Windows\ERUNT
2014-11-12 20:41 - 2014-11-12 20:41 - 01706808 _____ (Thisisu) C:\Users\Max Mengelberg\Desktop\JRT.exe
2014-11-12 20:39 - 2014-11-12 20:39 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-11-12 20:39 - 2014-11-12 20:39 - 00000000 ____D () C:\ProgramData\Package Cache
2014-11-12 20:28 - 2014-11-12 20:28 - 00014905 _____ () C:\Users\Max Mengelberg\Desktop\AdwCleaner[S0].txt
2014-11-12 20:26 - 2014-11-12 20:26 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Roaming\Tobit
2014-11-12 20:13 - 2014-11-12 20:23 - 00000000 ____D () C:\AdwCleaner
2014-11-12 20:11 - 2014-11-12 20:11 - 02140160 _____ () C:\Users\Max Mengelberg\Desktop\AdwCleaner_4.101.exe
2014-11-12 20:07 - 2014-11-12 20:07 - 00000049 _____ () C:\Users\Max Mengelberg\Desktop\mbam.txt
2014-11-12 19:40 - 2014-11-12 20:52 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-12 19:40 - 2014-11-12 19:40 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-11-12 19:40 - 2014-11-12 19:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-11-12 19:40 - 2014-11-12 19:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-12 19:40 - 2014-11-12 19:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-11-12 19:40 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-12 19:40 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-12 19:40 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-12 19:38 - 2014-11-12 19:39 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Max Mengelberg\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-11 20:11 - 2014-11-12 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-11-11 20:10 - 2014-11-12 20:52 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-11-11 20:09 - 2014-11-11 20:10 - 151804352 _____ () C:\Users\Max Mengelberg\Downloads\avira_free_antivirus_de_14.0.7.342.exe
2014-11-11 20:07 - 2014-11-11 20:07 - 00031201 _____ () C:\ComboFix.txt
2014-11-11 19:49 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-11-11 19:49 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-11-11 19:49 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-11-11 19:49 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-11-11 19:49 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-11-11 19:49 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-11-11 19:49 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-11-11 19:49 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-11-11 19:42 - 2014-11-11 20:07 - 00000000 ____D () C:\Qoobox
2014-11-11 19:42 - 2014-11-11 20:06 - 00000000 ____D () C:\Windows\erdnt
2014-11-11 19:40 - 2014-11-11 19:40 - 05598118 ____R (Swearware) C:\Users\Max Mengelberg\Desktop\ComboFix.exe
2014-11-11 19:32 - 2014-11-11 19:32 - 00001270 _____ () C:\Users\Max Mengelberg\Desktop\Revo Uninstaller.lnk
2014-11-11 19:32 - 2014-11-11 19:32 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-11-11 19:31 - 2014-11-11 19:31 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Max Mengelberg\Downloads\revosetup95.exe
2014-11-10 16:21 - 2014-11-12 20:59 - 00031757 _____ () C:\Users\Max Mengelberg\Desktop\FRST.txt
2014-11-10 16:21 - 2014-11-10 16:21 - 00044865 _____ () C:\Users\Max Mengelberg\Desktop\Addition.txt
2014-11-10 16:19 - 2014-11-10 16:20 - 00062400 _____ () C:\Users\Max Mengelberg\Downloads\FRST.txt
2014-11-10 16:19 - 2014-11-10 16:20 - 00044865 _____ () C:\Users\Max Mengelberg\Downloads\Addition.txt
2014-11-10 16:19 - 2014-11-10 16:18 - 02116096 _____ (Farbar) C:\Users\Max Mengelberg\Desktop\FRST64.exe
2014-11-10 16:18 - 2014-11-12 20:59 - 00000000 ____D () C:\FRST
2014-11-10 16:18 - 2014-11-10 16:18 - 02116096 _____ (Farbar) C:\Users\Max Mengelberg\Downloads\FRST64.exe
2014-11-10 16:16 - 2014-11-10 16:16 - 00006710 _____ () C:\Users\Max Mengelberg\Desktop\log.xml
2014-11-10 15:27 - 2014-11-10 19:39 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Roaming\Nico Mak Computing
2014-11-10 14:26 - 2014-11-10 14:26 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Roaming\QuickScan
2014-11-09 15:42 - 2014-11-09 15:42 - 00000479 _____ () C:\Users\Max Mengelberg\Desktop\Max Mengelberg (Galaxy - Verknüpfung.lnk
2014-11-02 18:33 - 2014-11-02 18:33 - 00104769 _____ () C:\Users\Max Mengelberg\Downloads\141102_Konto 444546204 _ A(1).zip
2014-11-02 18:32 - 2014-11-02 18:32 - 00104769 _____ () C:\Users\Max Mengelberg\Downloads\141102_Konto 444546204 _ A.zip
2014-11-02 18:10 - 2014-11-02 18:11 - 00000960 _____ () C:\Users\Max Mengelberg\Desktop\Inteco_13-234_Frisa_MeM.lnk
2014-11-01 09:55 - 2014-11-01 09:56 - 00001309 _____ () C:\Users\Max Mengelberg\Desktop\11.lnk
2014-10-30 09:28 - 2014-10-30 09:28 - 00000000 ____D () C:\Program Files\Google
2014-10-30 09:27 - 2014-10-30 09:28 - 00000000 ____D () C:\ProgramData\Google
2014-10-27 18:50 - 2014-10-27 18:53 - 365364423 _____ () C:\Users\Max Mengelberg\Downloads\Andalusien.zip
2014-10-26 14:10 - 2014-10-26 14:10 - 00001847 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-10-26 14:10 - 2014-10-26 14:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2014-10-26 14:10 - 2014-10-26 14:10 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-10-26 14:10 - 2014-10-26 14:10 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-10-23 19:03 - 2014-10-23 19:10 - 00000368 _____ () C:\Users\Max Mengelberg\Desktop\Visitenkarte.v2m
2014-10-23 19:03 - 2014-10-23 19:05 - 00000368 _____ () C:\Users\Max Mengelberg\Desktop\Visitenkarte.bak
2014-10-23 19:02 - 2014-10-23 19:02 - 00000368 _____ () C:\Users\Max Mengelberg\Documents\Visitenkarte.v2m
2014-10-23 18:51 - 2014-10-23 18:51 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Roaming\Avery
2014-10-23 18:50 - 2014-11-10 19:40 - 00000000 ____D () C:\ProgramData\Avery
2014-10-23 18:49 - 2014-10-23 18:49 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Local\Temp32ce20853bcb874bd0a9e2d387ad366c__
2014-10-23 18:49 - 2014-10-23 18:49 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Local\Temp24786dc9db3b9947f69c21b2e1854d76__
2014-10-23 18:48 - 2014-10-23 18:48 - 01048928 _____ () C:\Users\Max Mengelberg\Downloads\Avery-Zweckform-DesignPro-lnstall.exe
2014-10-23 17:43 - 2014-10-23 17:43 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Local\Tempad8d4e78ba2d6a4719c524a41c9ad285
2014-10-23 17:43 - 2014-10-23 17:43 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Local\Temp32ce20853bcb874bd0a9e2d387ad366c_
2014-10-23 17:43 - 2014-10-23 17:43 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Local\Temp24786dc9db3b9947f69c21b2e1854d76_
2014-10-23 17:42 - 2014-10-23 17:42 - 00000000 ____D () C:\Users\Max Mengelberg\ChromeExtensions
2014-10-23 17:42 - 2014-10-23 17:42 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Local\Tempdde92f4c4349613f7dc464a8b6d44229
2014-10-23 17:42 - 2014-10-23 17:42 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Local\Temp32ce20853bcb874bd0a9e2d387ad366c
2014-10-23 17:42 - 2014-10-23 17:42 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Local\Temp24786dc9db3b9947f69c21b2e1854d76
2014-10-23 17:41 - 2014-10-23 17:41 - 01048928 _____ () C:\Users\Max Mengelberg\Downloads\STvcard-GOLD-lnstall.exe
2014-10-23 17:26 - 2014-10-23 17:26 - 00001193 _____ () C:\Users\Max Mengelberg\Desktop\Visitenkarten In 2 Minuten.lnk
2014-10-23 17:26 - 2014-10-23 17:26 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sigel
2014-10-23 17:26 - 2014-10-23 17:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sigel
2014-10-23 17:26 - 2014-10-23 17:26 - 00000000 ____D () C:\Program Files (x86)\Sigel
2014-10-23 17:25 - 2014-10-25 10:17 - 00000000 ____D () C:\Windows\System32\Tasks\Abelssoft
2014-10-23 17:25 - 2014-10-25 10:17 - 00000000 ____D () C:\Program Files (x86)\CHIP Updater
2014-10-23 17:25 - 2014-10-23 17:26 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Local\Abelssoft
2014-10-23 17:25 - 2014-10-23 17:25 - 01125200 _____ () C:\Users\Max Mengelberg\Downloads\Visitenkarten in 2 Minuten - CHIP-Installer.exe
2014-10-23 17:25 - 2014-10-23 17:25 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Roaming\Abelssoft
2014-10-23 17:25 - 2014-10-23 17:25 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-10-21 10:38 - 2014-10-21 10:38 - 00168453 _____ () C:\Users\Max Mengelberg\Downloads\EO_Banjo_elbow_SWVE08LMCF.stp
2014-10-21 10:34 - 2014-10-21 10:34 - 00133081 _____ () C:\Users\Max Mengelberg\Downloads\EO_Banjo_elbow_SWVE08LMOMDCF.stp
2014-10-21 09:42 - 2014-10-21 09:42 - 00174790 _____ () C:\Users\Max Mengelberg\Downloads\EO_Union_elbow_W08ZL71.stp
2014-10-21 09:39 - 2014-10-21 09:39 - 00130075 _____ () C:\Users\Max Mengelberg\Downloads\EO_Union_elbow_W08S71X.stp
2014-10-20 16:37 - 2014-10-20 16:37 - 00143451 _____ () C:\Users\Max Mengelberg\Downloads\EO_Swivel_connector_GAI08LM71.stp
2014-10-20 16:26 - 2014-10-20 16:27 - 00157723 _____ () C:\Users\Max Mengelberg\Downloads\EO_Male_Stud_connector_GEO08LMCF.stp
2014-10-20 14:27 - 2014-10-20 14:27 - 00149634 _____ () C:\Users\Max Mengelberg\Downloads\EO_Swivel_union_GZ08LCF.stp
2014-10-20 09:04 - 2014-10-20 09:04 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Roaming\Oracle
2014-10-20 09:02 - 2014-10-20 09:01 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-10-20 09:01 - 2014-10-20 09:01 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-10-20 09:01 - 2014-10-20 09:01 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-10-20 09:01 - 2014-10-20 09:01 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-10-20 09:01 - 2014-10-20 09:01 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-16 17:54 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 17:54 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 17:54 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 17:54 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 17:54 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 17:54 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 17:54 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 17:54 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 17:54 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 17:54 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 17:54 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 17:54 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 17:54 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 17:54 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 17:54 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 17:54 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 17:54 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 17:54 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 17:54 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 17:54 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 17:54 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 17:54 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-16 17:54 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 17:54 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-16 17:54 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 17:54 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 17:54 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 17:54 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-16 17:54 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-16 17:54 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-16 17:54 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 17:54 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 17:54 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-16 17:54 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 17:54 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-16 17:54 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 17:54 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 17:54 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 17:54 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-16 17:54 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 17:54 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 17:54 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 17:54 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-16 17:54 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 17:54 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 17:54 - 2014-07-17 03:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 17:54 - 2014-07-17 03:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 17:54 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 17:54 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 17:54 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 17:54 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 17:54 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 17:54 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 17:54 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 17:54 - 2014-07-17 02:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 17:54 - 2014-07-17 02:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-16 17:54 - 2014-07-17 02:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-16 17:54 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-16 17:54 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-16 17:54 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 17:54 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 17:54 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 17:54 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-16 17:54 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-16 17:54 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 17:54 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-16 17:54 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 17:53 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 17:53 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 17:53 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 17:53 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 17:53 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 17:53 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 17:53 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 17:53 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 17:53 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 17:53 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 17:53 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 17:53 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 17:53 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-16 17:53 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 17:53 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 17:53 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 17:53 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 17:53 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 17:40 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 17:40 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 17:40 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-12 20:57 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-12 20:57 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-12 20:52 - 2011-10-07 19:11 - 00000000 ____D () C:\ProgramData\Avira
2014-11-12 20:52 - 2009-07-14 05:51 - 00173299 _____ () C:\Windows\setupact.log
2014-11-12 20:50 - 2013-11-01 08:34 - 00000000 ___RD () C:\Users\Max Mengelberg\Dropbox
2014-11-12 20:50 - 2013-11-01 08:27 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Roaming\Dropbox
2014-11-12 20:49 - 2011-10-04 08:00 - 00000000 ____D () C:\ProgramData\Sonic
2014-11-12 20:48 - 2014-08-01 15:39 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-11-12 20:48 - 2012-01-12 19:44 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-12 20:48 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-12 20:47 - 2011-10-04 00:16 - 01833684 _____ () C:\Windows\WindowsUpdate.log
2014-11-12 20:47 - 2010-11-21 04:47 - 00451244 _____ () C:\Windows\PFRO.log
2014-11-12 20:19 - 2012-01-12 19:44 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-12 20:04 - 2012-03-31 17:14 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-12 19:56 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Web
2014-11-12 19:37 - 2010-11-21 07:50 - 00714458 _____ () C:\Windows\system32\perfh007.dat
2014-11-12 19:37 - 2010-11-21 07:50 - 00154510 _____ () C:\Windows\system32\perfc007.dat
2014-11-12 19:37 - 2009-07-14 06:13 - 01649592 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-12 18:26 - 2011-10-08 17:40 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Roaming\SolidWorks
2014-11-12 10:02 - 2009-07-14 03:34 - 00000444 _____ () C:\Windows\win.ini
2014-11-11 23:04 - 2012-03-31 17:14 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-11 23:04 - 2012-03-31 17:14 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-11 23:04 - 2011-10-04 07:24 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-11 20:07 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-11-11 20:01 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-11-11 20:00 - 2009-07-14 03:34 - 19660800 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-11-11 20:00 - 2009-07-14 03:34 - 128712704 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-11-11 20:00 - 2009-07-14 03:34 - 01048576 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-11-11 20:00 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak
2014-11-11 20:00 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\SAM.bak
2014-11-11 10:37 - 2011-10-17 13:05 - 00000000 ____D () C:\temp
2014-11-10 19:43 - 2014-05-10 13:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-10 19:40 - 2011-10-04 07:35 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-11-10 11:48 - 2011-10-08 17:52 - 00000000 ____D () C:\Program Files\Common Files\SolidWorks Shared
2014-11-07 10:07 - 2012-02-17 13:12 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Local\CutePDF Writer
2014-11-02 18:55 - 2011-10-09 13:44 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular
2014-11-02 18:55 - 2011-10-07 19:58 - 00000000 ____D () C:\Users\Max Mengelberg
2014-11-01 20:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-30 09:28 - 2014-08-17 12:05 - 00000000 ____D () C:\Users\Max Mengelberg\AppData\Local\Adobe
2014-10-30 09:28 - 2012-01-12 19:44 - 00000000 ____D () C:\Program Files (x86)\Google
2014-10-29 09:46 - 2012-01-12 19:44 - 00002177 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-28 06:34 - 2010-11-21 04:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-25 10:14 - 2012-01-12 19:44 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-25 10:14 - 2012-01-12 19:44 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-24 09:23 - 2011-10-07 19:59 - 00111824 _____ () C:\Users\Max Mengelberg\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-24 09:21 - 2009-07-14 05:45 - 00405416 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-20 12:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-10-20 10:41 - 2011-10-09 12:10 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-10-20 10:40 - 2011-10-15 10:58 - 00000000 ____D () C:\ProgramData\Symantec
2014-10-20 10:40 - 2011-10-15 10:58 - 00000000 ____D () C:\ProgramData\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3}
2014-10-20 10:40 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Registration
2014-10-20 09:02 - 2013-10-20 12:09 - 00000000 ____D () C:\ProgramData\Oracle
2014-10-17 08:16 - 2014-05-06 23:35 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 23:11 - 2013-07-13 18:28 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 23:09 - 2011-10-09 11:33 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\Max Mengelberg\AppData\Local\Temp\avgnt.exe
C:\Users\Max Mengelberg\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpjpl8kz.dll
C:\Users\Max Mengelberg\AppData\Local\Temp\Quarantine.exe
C:\Users\Max Mengelberg\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-11-05 10:21
==================== End Of Log ============================ --- --- ---
Gruß
Pampel |