Chrome Erweiterung "Download Protect 2.2.5" lässt sich nicht entfernen

JuttaS. · 20.08.2014, 17:29

Hallo! Ich habe mir die Browsererweiterung "Download Protect 2.2.5" bedauerlicherweise aus Versehen auf meinen PC geholt. Ich habe bereits versucht sie zu löschen und CCleaner und Malwarebytes drüberlaufen lassen, aber es ist immer noch da, wenn auch deaktiviert. Könnt ihr mir helfen das Teil loszuwerden? Lg Jutta

Bootsektor · 20.08.2014, 19:45

Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem
Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
Bitte kein Crossposting ( posten in mehreren Foren).
Installiere oder deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu aufgefordert.
Poste die Logfiles direkt in deinen Thread in Code-Tags.
Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Posten in Code Tags
Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke.
Dazu:

Klicke über dem Antwortfenster auf die Raute #, dann steht dort in eckigen Klammern [] CODE /CODE.
Zwischen den beiden code-Bausteinen fügst Du dann deine Logfiles ein. Also CODE Logfile /CODE
Wenn die Logs zu lang sein sollten, dann teile sie bitte auf und poste sie dann hier in Deinem Thread, notfalls in mehreren Antworten.

Schritt 1
Poste bitte die Anhänge in CodeTags (siehe oben)

Schritt 2
Poste mit bitte das Log von Malwarebytes

JuttaS. · 21.08.2014, 10:35

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:52 on 20/08/2014 (Jutta)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-08-2014 01
Ran by Jutta (administrator) on JUTTAPC on 20-08-2014 17:53:51
Running from C:\Users\Jutta\Downloads
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
() C:\Windows\System32\KBEUGHR1.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Avanquest Software) C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
(Spotify Ltd) C:\Users\Jutta\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\RadioController\RfBtnHelper.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Spotify Ltd) C:\Users\Jutta\AppData\Roaming\Spotify\spotify.exe
() C:\Users\Jutta\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Jutta\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Jutta\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Jutta\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Users\Jutta\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Jutta\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20573_x64__8wekyb3d8bbwe\livecomm.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Jutta\Downloads\Defogger.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2873744 2012-11-20] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BtPreLoad] => C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-11-05] ()
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [LManager] => [X]
HKLM-x32\...\Run: [RadioController] => C:\Program Files (x86)\RadioController\RfBtnHelper.exe [111216 2013-03-12] (Dritek System Inc.)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-06] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1273448 2012-04-03] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191016 2014-05-14] (Geek Software GmbH)
HKLM-x32\...\Run: [Download Protect] => C:\ProgramData\dlprotect.exe [12800 2014-07-28] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [190032 2014-07-24] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1768041208-787304100-1710538151-1001\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2013-08-22] (Microsoft Corporation)
HKU\S-1-5-21-1768041208-787304100-1710538151-1002\...\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-1768041208-787304100-1710538151-1002\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [466656 2014-05-23] (Sony)
HKU\S-1-5-21-1768041208-787304100-1710538151-1002\...\Run: [Spotify Web Helper] => C:\Users\Jutta\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1178168 2014-07-17] (Spotify Ltd)
HKU\S-1-5-21-1768041208-787304100-1710538151-1002\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [457728 2013-09-30] (Microsoft Corporation)
HKU\S-1-5-21-1768041208-787304100-1710538151-1002\...\MountPoints2: {e7e8478f-4e22-11e3-be7c-208984642363} - "E:\Startme.exe" 
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
AppInit_DLLs: ,C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [141336 2013-09-05] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer Backup Manager Tray.lnk
ShortcutTarget: Acer Backup Manager Tray.lnk -> C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM - {00C1F671-9C43-498A-B47C-EB1909040B49} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKCU - {00C1F671-9C43-498A-B47C-EB1909040B49} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: V-bates -> {21EAF666-26B3-4a3c-ABD0-CA2F5A326744} -> C:\Program Files\V-bates\Extension64.dll No File
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: DownloadProtect Extension -> {C654F3FE-8E84-4BB7-87CF-8D9171FC3C73} -> C:\Program Files\{A8452725-D442-4D14-B1B7-DCB95671F672}\{578D31DC-1898-4492-BF32-FBE9551BDE32}.bin (Download Protect)
BHO-x32: V-bates -> {21EAF666-26B3-4a3c-ABD0-CA2F5A326744} -> C:\Program Files\V-bates\Extension32.dll No File
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: DownloadProtect Extension -> {C654F3FE-8E84-4BB7-87CF-8D9171FC3C73} -> C:\Program Files (x86)\{2D8F1F5A-C304-4CE7-8B7D-1EC03ABEDCFC}\{04C67CAB-A711-44AB-A1BB-A86655F630F6}.bin (Download Protect)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\zsdyt9r2.default
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC)
FF user.js: detected! => C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\zsdyt9r2.default\user.js
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-06-07]
FF HKLM-x32\...\Firefox\Extensions: [{61CB556D-F185-4A76-A54E-30F7B29E8AD1}] - C:\WINDOWS\Installer\{1949ECB2-E22D-4EEF-B078-6144161B7509}\{61CB556D-F185-4A76-A54E-30F7B29E8AD1}.xpi
FF Extension: Download Protect - C:\WINDOWS\Installer\{1949ECB2-E22D-4EEF-B078-6144161B7509}\{61CB556D-F185-4A76-A54E-30F7B29E8AD1}.xpi [2014-08-18]
FF Extension: No Name - C:\WINDOWS\Installer\{2BBB60CE-AE68-4CEB-BAE3-3A139930D9D5}\{C17606FE-6872-4033-B125-AEDC5E3F233A}.xpi []

Chrome: 
=======
CHR HomePage: hxxp://www.google.de?hl=de&gl=de
CHR StartupUrls: "hxxp://www.google.de?hl=de&gl=de"
CHR Extension: (Google Docs) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-10-23]
CHR Extension: (Google Drive) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-10-23]
CHR Extension: (YouTube) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-10-23]
CHR Extension: (Google-Suche) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-10-23]
CHR Extension: (Download Protect) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\eoogpppjmklmigkkladmlijaocglclok [2014-08-19]
CHR Extension: (AdBlock) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-10-25]
CHR Extension: (Google Wallet) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-23]
CHR Extension: (Citavi Picker) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-06-08]
CHR Extension: (Google Mail) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-10-23]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - C:\Program Files (x86)\Citavi 4\Pickers\Chrome\ChromePicker.crx [2014-02-07]
CHR HKLM-x32\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [2014-03-05]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-06] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-06] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1021520 2014-08-06] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [231040 2012-11-05] (Qualcomm Atheros Commnucations)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-24] (Avira Operations GmbH & Co. KG)
R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.) [File not signed]
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2449552 2012-10-25] (Acer Incorporated)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-17] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658064 2012-10-23] (Acer Incorporated)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-11-03] (NTI Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [96880 2013-03-12] (Dritek System INC.)
R2 tzutil64; C:\WINDOWS\system32\KBEUGHR1.exe [137216 2014-07-28] () [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-11-09] (Atheros)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [42040 2014-07-10] (Avira Operations GmbH & Co. KG)
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 CVPNDRVA; C:\WINDOWS\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2013-03-12] (Dritek System Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
S3 BTATH_LWFLT; \SystemRoot\system32\DRIVERS\btath_lwflt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-20 17:53 - 2014-08-20 17:53 - 02101760 _____ (Farbar) C:\Users\Jutta\Downloads\FRST64.exe
2014-08-20 17:53 - 2014-08-20 17:53 - 00022563 _____ () C:\Users\Jutta\Downloads\FRST.txt
2014-08-20 17:50 - 2014-08-20 17:52 - 00000472 _____ () C:\Users\Jutta\Downloads\defogger_disable.log
2014-08-20 17:50 - 2014-08-20 17:50 - 00000000 _____ () C:\Users\Jutta\defogger_reenable
2014-08-20 17:48 - 2014-08-20 17:48 - 00050477 _____ () C:\Users\Jutta\Downloads\Defogger.exe
2014-08-18 18:30 - 2014-08-18 18:30 - 00000000 ____D () C:\Program Files\{A8452725-D442-4D14-B1B7-DCB95671F672}
2014-08-18 18:30 - 2014-08-18 18:30 - 00000000 ____D () C:\Program Files (x86)\{2D8F1F5A-C304-4CE7-8B7D-1EC03ABEDCFC}
2014-08-14 12:52 - 2014-08-14 12:52 - 00001511 _____ () C:\Users\Public\Desktop\Die Sims 4 Erstelle einen Sim-Demo.lnk
2014-08-14 12:52 - 2014-08-14 12:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4 Erstelle einen Sim-Demo
2014-08-14 12:40 - 2014-08-14 12:43 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-08-14 12:40 - 2014-08-14 12:42 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Origin
2014-08-14 09:57 - 2014-08-14 09:57 - 00000000 ____D () C:\ProgramData\SystemRequirementsLab
2014-08-14 09:57 - 2014-08-14 09:57 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-08-13 21:06 - 2014-08-02 05:11 - 00918528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-08-13 07:29 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-08-13 07:29 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-08-13 07:29 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-08-13 07:29 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-08-13 07:29 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-08-13 07:29 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-08-13 07:29 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2014-08-13 07:29 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-08-13 07:29 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-08-13 07:29 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-08-13 07:29 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\JavaScriptCollectionAgent.dll
2014-08-13 07:29 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-08-13 07:29 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-08-13 07:29 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-08-13 07:29 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2014-08-13 07:29 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-08-13 07:29 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2014-08-13 07:29 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-08-13 07:29 - 2014-07-25 13:43 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-08-13 07:29 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 07:29 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-08-13 07:29 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-08-13 07:29 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-08-13 07:29 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-08-13 07:29 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-08-13 07:29 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-08-13 07:29 - 2014-07-25 13:09 - 00291840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-08-13 07:29 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-08-13 07:29 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-08-13 07:29 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-08-13 07:29 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-08-13 07:29 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-08-13 07:29 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-08-13 07:29 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-08-13 07:29 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-08-13 07:28 - 2014-06-20 03:48 - 01273184 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2014-08-13 07:28 - 2014-06-20 01:52 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2014-08-13 07:28 - 2014-06-13 03:15 - 00517528 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2014-08-13 07:28 - 2014-06-13 03:14 - 01557848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2014-08-13 07:28 - 2014-06-13 02:10 - 00406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2014-08-13 07:28 - 2014-06-06 13:34 - 02133504 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2014-08-13 07:27 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2014-08-13 07:27 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2014-08-13 07:27 - 2014-05-31 08:27 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2014-08-13 07:26 - 2014-08-07 04:12 - 01336624 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2014-08-13 07:26 - 2014-08-07 00:39 - 04148224 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-08-13 07:26 - 2014-08-02 05:56 - 01064448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2014-08-13 07:26 - 2014-07-15 20:16 - 03048880 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcMon.exe
2014-08-13 07:26 - 2014-07-15 10:29 - 03118080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wpc.dll
2014-08-13 07:26 - 2014-07-15 10:22 - 02861056 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebSync.dll
2014-08-13 07:26 - 2014-07-15 10:03 - 02344448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wpc.dll
2014-08-13 07:26 - 2014-07-12 06:17 - 00623616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2014-08-13 07:26 - 2014-07-10 06:16 - 00716800 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2014-08-13 07:26 - 2014-07-10 06:03 - 04756992 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-08-13 07:26 - 2014-07-10 05:33 - 01120256 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-08-13 07:26 - 2014-06-05 16:13 - 00216368 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
2014-08-13 07:26 - 2014-06-05 15:14 - 00189016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll
2014-08-13 07:26 - 2014-06-04 11:27 - 00114520 _____ (Microsoft Corporation) C:\WINDOWS\system32\consent.exe
2014-08-13 07:26 - 2014-06-04 07:31 - 00356352 _____ (Microsoft Corporation) C:\WINDOWS\system32\msihnd.dll
2014-08-13 07:26 - 2014-06-04 07:22 - 02790912 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2014-08-13 07:26 - 2014-06-04 06:43 - 00281088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msihnd.dll
2014-08-13 07:26 - 2014-06-04 06:38 - 03304448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2014-08-13 07:26 - 2014-06-04 04:15 - 02642944 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-08-13 07:26 - 2014-06-04 04:14 - 02318336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-08-13 07:26 - 2014-06-02 04:10 - 00423768 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2014-08-13 07:26 - 2014-05-31 12:07 - 00467800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2014-08-13 07:26 - 2014-05-31 12:07 - 00440664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbport.sys
2014-08-13 07:26 - 2014-05-31 12:07 - 00419672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2014-08-13 07:26 - 2014-05-31 12:07 - 00089944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbehci.sys
2014-08-13 07:26 - 2014-05-31 12:07 - 00027480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbd.sys
2014-08-13 07:26 - 2014-05-31 08:30 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbuhci.sys
2014-08-13 07:26 - 2014-05-31 08:27 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WUDFPf.sys
2014-08-13 07:26 - 2014-05-31 08:26 - 00227840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WUDFRd.sys
2014-08-13 07:26 - 2014-05-31 06:01 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFHost.exe
2014-08-13 07:26 - 2014-05-31 06:01 - 00209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFPlatform.dll
2014-08-13 07:26 - 2014-05-31 06:01 - 00099840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFSvc.dll
2014-08-13 07:26 - 2014-05-27 17:53 - 02518360 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-08-13 07:26 - 2014-05-27 11:56 - 00323584 _____ (Microsoft Corporation) C:\WINDOWS\system32\DaOtpCredentialProvider.dll
2014-08-13 07:26 - 2014-05-27 11:53 - 00270848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DaOtpCredentialProvider.dll
2014-08-13 07:26 - 2014-05-17 06:59 - 16871936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2014-08-13 07:26 - 2014-05-17 06:13 - 12711424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2014-08-13 07:26 - 2014-05-13 09:01 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\BulkOperationHost.exe
2014-08-13 07:26 - 2014-05-13 07:07 - 02844160 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2014-08-13 07:26 - 2014-05-13 06:41 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2014-08-13 07:26 - 2014-05-13 06:26 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveShell.dll
2014-08-13 07:26 - 2014-05-13 05:59 - 01035264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2014-08-13 07:26 - 2014-05-13 05:31 - 00265216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SkyDriveShell.dll
2014-08-13 07:26 - 2014-05-03 13:29 - 01726224 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-08-13 07:26 - 2014-05-03 11:20 - 01473080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-08-13 07:26 - 2014-05-03 07:36 - 00997888 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2014-08-13 07:26 - 2014-05-03 07:19 - 00071168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncobjapi.dll
2014-08-13 07:26 - 2014-05-03 07:08 - 00301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\framedynos.dll
2014-08-13 07:26 - 2014-05-03 07:07 - 00262656 _____ (Microsoft Corporation) C:\WINDOWS\system32\framedyn.dll
2014-08-13 07:26 - 2014-05-03 06:46 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncobjapi.dll
2014-08-13 07:26 - 2014-05-03 06:37 - 00235008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\framedynos.dll
2014-08-13 07:26 - 2014-05-03 06:37 - 00207360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\framedyn.dll
2014-08-13 07:26 - 2014-05-03 01:26 - 00050745 _____ () C:\WINDOWS\system32\srms.dat
2014-08-13 07:26 - 2014-05-01 07:44 - 01025536 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2014-08-13 07:26 - 2014-04-30 08:43 - 00071680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vwififlt.sys
2014-08-13 07:26 - 2014-04-30 08:41 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2014-08-13 07:26 - 2014-04-30 08:41 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\agilevpn.sys
2014-08-13 07:26 - 2014-04-30 08:41 - 00038912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vwifimp.sys
2014-08-13 07:26 - 2014-04-30 07:45 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Robocopy.exe
2014-08-13 07:26 - 2014-04-30 06:48 - 00106496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Robocopy.exe
2014-08-13 07:26 - 2014-04-30 06:24 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcsvc6.dll
2014-08-13 07:26 - 2014-04-30 06:23 - 00353280 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore.dll
2014-08-13 07:26 - 2014-04-30 06:23 - 00271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore6.dll
2014-08-13 07:26 - 2014-04-30 06:23 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcsvc.dll
2014-08-13 07:26 - 2014-04-30 06:14 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2014-08-13 07:26 - 2014-04-30 05:59 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2014-08-13 07:26 - 2014-04-30 05:46 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore.dll
2014-08-13 07:26 - 2014-04-30 05:46 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore6.dll
2014-08-13 07:26 - 2014-04-30 05:46 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcsvc6.dll
2014-08-13 07:26 - 2014-04-30 05:45 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcsvc.dll
2014-08-13 07:26 - 2014-04-30 05:42 - 00403968 _____ (Microsoft Corporation) C:\WINDOWS\system32\vpnike.dll
2014-08-13 07:26 - 2014-04-29 00:40 - 00721408 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2014-08-13 07:26 - 2014-04-27 00:03 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2014-08-13 07:26 - 2014-04-26 22:14 - 02144984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2014-08-13 07:26 - 2014-04-26 18:39 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2014-08-13 07:26 - 2014-04-14 11:37 - 02125344 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2014-08-13 07:26 - 2014-04-14 10:08 - 01797896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2014-08-13 07:26 - 2014-04-14 07:18 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8thk.dll
2014-08-13 07:26 - 2014-04-09 08:11 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2014-08-13 07:26 - 2014-04-09 07:20 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2014-08-12 09:33 - 2014-08-12 09:37 - 00038948 _____ () C:\Users\Jutta\Downloads\Addition.txt
2014-08-12 09:32 - 2014-08-20 17:53 - 00000000 ____D () C:\FRST
2014-08-12 09:11 - 2014-08-12 09:11 - 00013824 ___SH () C:\Users\Jutta\AppData\Local\Thumbs.db
2014-08-12 09:09 - 2014-08-12 09:09 - 00002772 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2014-08-12 09:09 - 2014-08-12 09:09 - 00000838 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-12 09:09 - 2014-08-12 09:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-12 09:08 - 2014-08-12 09:08 - 03738080 _____ (Piriform Ltd) C:\Users\Jutta\Downloads\ccsetup416_slim.exe
2014-08-12 08:40 - 2014-08-12 08:41 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-12 08:40 - 2014-08-12 08:40 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-12 08:40 - 2014-08-12 08:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-12 08:40 - 2014-08-12 08:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-12 08:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-08-12 08:40 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-08-12 08:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-08-12 08:31 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\SysWOW64\sqlite3.dll
2014-08-12 08:30 - 2014-08-12 08:30 - 01366203 _____ () C:\Users\Jutta\Downloads\adwcleaner_3.304.exe
2014-08-08 18:07 - 2014-08-19 13:10 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-08-07 08:49 - 2014-08-07 08:55 - 00001157 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-06 22:35 - 2014-08-06 22:35 - 00000000 ____D () C:\ProgramData\Sun
2014-08-06 22:35 - 2014-08-06 22:35 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-06 22:35 - 2014-08-06 22:34 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-08-06 22:34 - 2014-08-06 22:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-06 22:34 - 2014-08-06 22:34 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-08-06 22:34 - 2014-08-06 22:34 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-08-06 22:34 - 2014-08-06 22:34 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-08-06 22:34 - 2014-08-06 22:34 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-06 22:31 - 2014-08-06 22:31 - 00918440 _____ (Oracle Corporation) C:\Users\Jutta\Downloads\chromeinstall-7u67.exe
2014-07-30 23:42 - 2014-07-30 23:43 - 16806776 _____ (DsNET Corp ) C:\Users\Jutta\Downloads\aTubeCatcher.exe
2014-07-28 11:12 - 2014-07-28 11:12 - 00137216 _____ () C:\WINDOWS\system32\KBEUGHR1.exe
2014-07-28 11:12 - 2014-07-28 11:12 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-07-28 11:11 - 2014-07-28 11:11 - 00148480 _____ () C:\WINDOWS\system32\DlProtectSvc.exe
2014-07-27 12:16 - 2014-07-27 12:16 - 00001480 _____ () C:\Users\Jutta\AppData\Local\recently-used.xbel
2014-07-27 12:11 - 2014-07-27 12:16 - 00000000 ____D () C:\Users\Jutta\AppData\Local\gtk-2.0
2014-07-27 12:11 - 2014-07-27 12:11 - 00000000 ____D () C:\Users\Jutta\.thumbnails
2014-07-27 11:21 - 2014-07-27 12:18 - 00000000 ____D () C:\Users\Jutta\.gimp-2.8
2014-07-27 11:21 - 2014-07-27 11:21 - 00000000 ____D () C:\Users\Jutta\AppData\Local\gegl-0.2
2014-07-27 11:14 - 2014-08-12 08:28 - 00000000 ____D () C:\Program Files\GIMP 2
2014-07-27 11:11 - 2014-07-27 11:11 - 00003612 _____ () C:\WINDOWS\System32\Tasks\avgntfltavipbbavkmgr
2014-07-27 11:05 - 2014-07-27 11:06 - 13483938 _____ () C:\Users\Jutta\Downloads\JPG-Illuminator_v459.zip
2014-07-27 11:04 - 2014-07-27 11:04 - 00826192 _____ (Chip Digital GmbH) C:\Users\Jutta\Downloads\JPG Illuminator - CHIP-Installer.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-20 17:54 - 2014-08-20 17:53 - 00022563 _____ () C:\Users\Jutta\Downloads\FRST.txt
2014-08-20 17:53 - 2014-08-20 17:53 - 02101760 _____ (Farbar) C:\Users\Jutta\Downloads\FRST64.exe
2014-08-20 17:53 - 2014-08-12 09:32 - 00000000 ____D () C:\FRST
2014-08-20 17:52 - 2014-08-20 17:50 - 00000472 _____ () C:\Users\Jutta\Downloads\defogger_disable.log
2014-08-20 17:52 - 2013-10-23 10:15 - 00001124 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-20 17:50 - 2014-08-20 17:50 - 00000000 _____ () C:\Users\Jutta\defogger_reenable
2014-08-20 17:50 - 2013-10-18 08:45 - 00000000 ____D () C:\Users\Jutta
2014-08-20 17:48 - 2014-08-20 17:48 - 00050477 _____ () C:\Users\Jutta\Downloads\Defogger.exe
2014-08-20 17:47 - 2014-02-14 09:35 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\Spotify
2014-08-20 17:32 - 2014-03-15 14:32 - 00000298 _____ () C:\WINDOWS\Tasks\FF Watcher {1107A3EF-61B5-4AF4-8C49-16775FB0A1A7}.job
2014-08-20 17:30 - 2013-10-18 08:44 - 01943651 _____ () C:\WINDOWS\WindowsUpdate.log
2014-08-20 17:16 - 2013-09-30 06:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-08-20 17:16 - 2013-09-30 05:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-08-20 17:16 - 2013-09-30 05:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-08-20 17:13 - 2013-08-22 16:46 - 00339261 _____ () C:\WINDOWS\setupact.log
2014-08-20 17:12 - 2014-02-14 09:35 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Spotify
2014-08-20 17:02 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-08-20 14:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-08-20 14:19 - 2014-03-05 15:18 - 00000378 _____ () C:\WINDOWS\Tasks\APSnotifierCA.job
2014-08-20 11:41 - 2013-10-15 05:29 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1768041208-787304100-1710538151-1002
2014-08-20 11:13 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-08-20 09:47 - 2013-10-23 10:15 - 00002199 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-20 09:46 - 2013-10-23 10:15 - 00001120 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-20 09:46 - 2013-10-18 09:39 - 00000000 ___DO () C:\Users\Jutta\SkyDrive
2014-08-19 21:12 - 2013-10-18 10:38 - 00003926 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{969F4F97-82F5-40F1-80F1-9910D56C3A15}
2014-08-19 13:10 - 2014-08-08 18:07 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-08-18 18:30 - 2014-08-18 18:30 - 00000000 ____D () C:\Program Files\{A8452725-D442-4D14-B1B7-DCB95671F672}
2014-08-18 18:30 - 2014-08-18 18:30 - 00000000 ____D () C:\Program Files (x86)\{2D8F1F5A-C304-4CE7-8B7D-1EC03ABEDCFC}
2014-08-16 08:57 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-08-16 08:57 - 2013-08-22 16:44 - 00374984 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-08-16 08:56 - 2014-02-26 15:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-16 08:56 - 2013-09-29 21:04 - 00169556 _____ () C:\WINDOWS\PFRO.log
2014-08-16 08:55 - 2013-08-22 15:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2014-08-16 08:53 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-08-16 08:53 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-08-16 08:53 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\MediaViewer
2014-08-16 08:53 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\FileManager
2014-08-16 08:53 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Camera
2014-08-15 13:54 - 2013-10-17 06:35 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-08-15 13:54 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-08-15 13:49 - 2013-10-17 06:35 - 99218768 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-08-14 12:59 - 2013-10-24 12:03 - 00000000 ____D () C:\ProgramData\Origin
2014-08-14 12:59 - 2013-10-23 10:24 - 00000000 ____D () C:\Users\Jutta\Documents\Electronic Arts
2014-08-14 12:59 - 2013-10-22 13:17 - 00000000 ____D () C:\ProgramData\Electronic Arts
2014-08-14 12:52 - 2014-08-14 12:52 - 00001511 _____ () C:\Users\Public\Desktop\Die Sims 4 Erstelle einen Sim-Demo.lnk
2014-08-14 12:52 - 2014-08-14 12:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4 Erstelle einen Sim-Demo
2014-08-14 12:43 - 2014-08-14 12:40 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-08-14 12:42 - 2014-08-14 12:40 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Origin
2014-08-14 12:42 - 2013-10-24 12:04 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\Origin
2014-08-14 12:41 - 2013-10-24 12:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2014-08-14 12:41 - 2013-10-24 12:03 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-08-14 09:57 - 2014-08-14 09:57 - 00000000 ____D () C:\ProgramData\SystemRequirementsLab
2014-08-14 09:57 - 2014-08-14 09:57 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-08-13 14:01 - 2013-10-18 09:59 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-13 07:19 - 2014-04-10 12:11 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-08-13 07:19 - 2014-04-10 12:11 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-08-12 09:37 - 2014-08-12 09:33 - 00038948 _____ () C:\Users\Jutta\Downloads\Addition.txt
2014-08-12 09:27 - 2013-10-26 18:36 - 00000000 ____D () C:\AdwCleaner
2014-08-12 09:11 - 2014-08-12 09:11 - 00013824 ___SH () C:\Users\Jutta\AppData\Local\Thumbs.db
2014-08-12 09:09 - 2014-08-12 09:09 - 00002772 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2014-08-12 09:09 - 2014-08-12 09:09 - 00000838 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-12 09:09 - 2014-08-12 09:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-12 09:08 - 2014-08-12 09:08 - 03738080 _____ (Piriform Ltd) C:\Users\Jutta\Downloads\ccsetup416_slim.exe
2014-08-12 08:41 - 2014-08-12 08:40 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-12 08:40 - 2014-08-12 08:40 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-12 08:40 - 2014-08-12 08:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-12 08:40 - 2014-08-12 08:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-12 08:40 - 2013-10-29 21:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-12 08:30 - 2014-08-12 08:30 - 01366203 _____ () C:\Users\Jutta\Downloads\adwcleaner_3.304.exe
2014-08-12 08:28 - 2014-07-27 11:14 - 00000000 ____D () C:\Program Files\GIMP 2
2014-08-09 09:08 - 2013-11-25 21:50 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-08-09 09:02 - 2014-05-18 19:39 - 00201216 ___SH () C:\Users\Jutta\Desktop\Thumbs.db
2014-08-09 09:02 - 2013-10-27 16:04 - 00000000 ____D () C:\Users\Jutta\Documents\UNI
2014-08-08 20:25 - 2013-10-18 10:45 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Deployment
2014-08-08 18:07 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-08-07 08:55 - 2014-08-07 08:49 - 00001157 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-07 08:55 - 2014-05-31 21:20 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-07 08:55 - 2013-10-23 10:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-07 08:55 - 2013-10-23 10:25 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-07 08:49 - 2013-10-23 10:25 - 00000000 ____D () C:\ProgramData\Avira
2014-08-07 04:12 - 2014-08-13 07:26 - 01336624 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2014-08-07 00:39 - 2014-08-13 07:26 - 04148224 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-08-06 22:35 - 2014-08-06 22:35 - 00000000 ____D () C:\ProgramData\Sun
2014-08-06 22:35 - 2014-08-06 22:35 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-06 22:35 - 2014-08-06 22:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-06 22:34 - 2014-08-06 22:35 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-08-06 22:34 - 2014-08-06 22:34 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-08-06 22:34 - 2014-08-06 22:34 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-08-06 22:34 - 2014-08-06 22:34 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-08-06 22:34 - 2014-08-06 22:34 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-06 22:31 - 2014-08-06 22:31 - 00918440 _____ (Oracle Corporation) C:\Users\Jutta\Downloads\chromeinstall-7u67.exe
2014-08-02 05:56 - 2014-08-13 07:26 - 01064448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2014-08-02 05:11 - 2014-08-13 21:06 - 00918528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-08-02 02:17 - 2013-08-22 17:38 - 00704480 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-08-02 02:17 - 2013-08-22 17:38 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-01 07:42 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-07-30 23:43 - 2014-07-30 23:42 - 16806776 _____ (DsNET Corp ) C:\Users\Jutta\Downloads\aTubeCatcher.exe
2014-07-28 11:12 - 2014-07-28 11:12 - 00137216 _____ () C:\WINDOWS\system32\KBEUGHR1.exe
2014-07-28 11:12 - 2014-07-28 11:12 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-07-28 11:11 - 2014-07-28 11:11 - 00148480 _____ () C:\WINDOWS\system32\DlProtectSvc.exe
2014-07-27 12:18 - 2014-07-27 11:21 - 00000000 ____D () C:\Users\Jutta\.gimp-2.8
2014-07-27 12:16 - 2014-07-27 12:16 - 00001480 _____ () C:\Users\Jutta\AppData\Local\recently-used.xbel
2014-07-27 12:16 - 2014-07-27 12:11 - 00000000 ____D () C:\Users\Jutta\AppData\Local\gtk-2.0
2014-07-27 12:11 - 2014-07-27 12:11 - 00000000 ____D () C:\Users\Jutta\.thumbnails
2014-07-27 11:21 - 2014-07-27 11:21 - 00000000 ____D () C:\Users\Jutta\AppData\Local\gegl-0.2
2014-07-27 11:11 - 2014-07-27 11:11 - 00003612 _____ () C:\WINDOWS\System32\Tasks\avgntfltavipbbavkmgr
2014-07-27 11:06 - 2014-07-27 11:05 - 13483938 _____ () C:\Users\Jutta\Downloads\JPG-Illuminator_v459.zip
2014-07-27 11:04 - 2014-07-27 11:04 - 00826192 _____ (Chip Digital GmbH) C:\Users\Jutta\Downloads\JPG Illuminator - CHIP-Installer.exe
2014-07-27 10:53 - 2013-03-12 07:49 - 00000000 ____D () C:\ProgramData\CyberLink
2014-07-27 10:52 - 2014-06-01 00:13 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Cyberlink
2014-07-25 18:12 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-07-25 16:52 - 2014-08-13 07:29 - 23645696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-07-25 15:51 - 2014-08-13 07:29 - 17524224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-07-25 15:28 - 2014-08-13 07:29 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-07-25 15:25 - 2014-08-13 07:29 - 02774528 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-07-25 15:25 - 2014-08-13 07:29 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-07-25 14:59 - 2014-08-13 07:29 - 00758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-07-25 14:40 - 2014-08-13 07:29 - 00452096 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2014-07-25 14:34 - 2014-08-13 07:29 - 00455168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-07-25 14:30 - 2014-08-13 07:29 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-07-25 14:28 - 2014-08-13 07:29 - 05824512 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-07-25 14:28 - 2014-08-13 07:29 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\JavaScriptCollectionAgent.dll
2014-07-25 14:21 - 2014-08-13 07:29 - 02184704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-07-25 14:17 - 2014-08-13 07:29 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-07-25 14:10 - 2014-08-13 07:29 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-07-25 14:08 - 2014-08-13 07:29 - 00597504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2014-07-25 14:06 - 2014-08-13 07:29 - 04204032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-07-25 13:52 - 2014-08-13 07:29 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2014-07-25 13:47 - 2014-08-13 07:29 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-07-25 13:43 - 2014-08-13 07:29 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-07-25 13:43 - 2014-08-13 07:29 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-25 13:42 - 2014-08-13 07:29 - 00692736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-07-25 13:39 - 2014-08-13 07:29 - 02087936 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-07-25 13:34 - 2014-08-13 07:29 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-07-25 13:29 - 2014-08-13 07:29 - 00239616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-07-25 13:23 - 2014-08-13 07:29 - 13547008 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-07-25 13:13 - 2014-08-13 07:29 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-07-25 13:09 - 2014-08-13 07:29 - 00291840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-07-25 13:07 - 2014-08-13 07:29 - 02001920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-07-25 13:03 - 2014-08-13 07:29 - 11772928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-07-25 12:52 - 2014-08-13 07:29 - 02266624 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-07-25 12:26 - 2014-08-13 07:29 - 01431040 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-07-25 12:17 - 2014-08-13 07:29 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-07-25 12:09 - 2014-08-13 07:29 - 00704512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-07-25 12:05 - 2014-08-13 07:29 - 01792512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-07-25 12:00 - 2014-08-13 07:29 - 01169920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-07-21 13:36 - 2013-10-23 14:42 - 01054720 ___SH () C:\Users\Jutta\Downloads\Thumbs.db

Files to move or delete:
====================
C:\ProgramData\dlprotect.exe


Some content of TEMP:
====================
C:\Users\Jutta\AppData\Local\Temp\58250uninstall.exe
C:\Users\Jutta\AppData\Local\Temp\a2zLyrics_1060-8102_v122.exe
C:\Users\Jutta\AppData\Local\Temp\appshat-distribution.exe
C:\Users\Jutta\AppData\Local\Temp\avgnt.exe
C:\Users\Jutta\AppData\Local\Temp\BackupSetup.exe
C:\Users\Jutta\AppData\Local\Temp\COMAP.EXE
C:\Users\Jutta\AppData\Local\Temp\EADB850.exe
C:\Users\Jutta\AppData\Local\Temp\EADB8DE.exe
C:\Users\Jutta\AppData\Local\Temp\EADE272.exe
C:\Users\Jutta\AppData\Local\Temp\extension1198965671026689626.dll
C:\Users\Jutta\AppData\Local\Temp\extension3468924565051178888.dll
C:\Users\Jutta\AppData\Local\Temp\extension3919176333743683483.dll
C:\Users\Jutta\AppData\Local\Temp\extension4520323638078928898.dll
C:\Users\Jutta\AppData\Local\Temp\extension4544361943483554033.dll
C:\Users\Jutta\AppData\Local\Temp\extension5106180114494202662.dll
C:\Users\Jutta\AppData\Local\Temp\extension5158680092704645210.dll
C:\Users\Jutta\AppData\Local\Temp\extension5940112321691308842.dll
C:\Users\Jutta\AppData\Local\Temp\extension8257857011519117102.dll
C:\Users\Jutta\AppData\Local\Temp\extension8858833335510847471.dll
C:\Users\Jutta\AppData\Local\Temp\fam-installer.exe
C:\Users\Jutta\AppData\Local\Temp\fmp-2.0.7-win32.exe
C:\Users\Jutta\AppData\Local\Temp\MoviesToolbarSetup_Somoto_9_10_2013.exe
C:\Users\Jutta\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Jutta\AppData\Local\Temp\ose00000.exe
C:\Users\Jutta\AppData\Local\Temp\sp-latest.exe
C:\Users\Jutta\AppData\Local\Temp\Sqlite3.dll
C:\Users\Jutta\AppData\Local\Temp\SRLDetectionLibrary2591113819306373289.dll
C:\Users\Jutta\AppData\Local\Temp\UninstallEADM.dll
C:\Users\Jutta\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\Jutta\AppData\Local\Temp\vpnclient_setup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-16 21:42

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-08-2014 01
Ran by Jutta at 2014-08-12 09:36:30
Running from C:\Users\Jutta\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 clear.fi SDK - Video 2 (x32 Version: 2.1.2128 - CyberLink Corp.) Hidden
 clear.fi SDK- Movie 2 (x32 Version: 2.1.2112 - CyberLink Corp.) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{9DDDF20E-9FD1-4434-A43E-E7889DBC9420}) (Version: 4.0.0.0071 - NTI Corporation)
Acer Device Fast-lane (HKLM\...\{3F62D2FD-13C1-49A2-8B5D-47623D9460D7}) (Version: 1.00.3011 - Acer Incorporated)
Acer Instant Update Service (HKLM\...\{8215A318-CC27-435E-B3EA-2E3443C8998C}) (Version: 1.00.3013 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3011 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3012 - Acer Incorporated)
AcerCloud (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 2.01.3125 - Acer Incorporated)
AcerCloud Docs (HKLM-x32\...\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.00.3204 - Acer Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
aTube Catcher (HKLM-x32\...\aTube Catcher) (Version: 3.8.7943 - DsNET Corp)
Avira (HKLM-x32\...\{9590977b-7b6f-467e-a11a-efa1fae804da}) (Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
Backup Manager v4 (x32 Version: 4.0.0.0071 - NTI Corporation) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom Card Reader Driver Installer (HKLM\...\{F0A7DF2F-0BE0-470F-B137-D7A19F977189}) (Version: 15.4.7.1 - Broadcom Corporation)
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.3.5.0 - Canon Inc.)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.0 - Canon Inc.)
Canon iP7200 series Benutzerregistrierung (HKLM-x32\...\Canon iP7200 series Benutzerregistrierung) (Version:  - Canon Inc.‎)
Canon iP7200 series On-screen Manual (HKLM-x32\...\Canon iP7200 series On-screen Manual) (Version: 7.5.0 - Canon Inc.)
Canon iP7200 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP7200_series) (Version:  - Canon Inc.)
Canon MG5200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series) (Version:  - )
Canon MX880 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX880_series) (Version:  - )
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 1.0.0 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 1.0.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.0.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.3.0.15 - Swiss Academic Software)
clear.fi Media (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.01.3112 - Acer Incorporated)
clear.fi Photo (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 2.01.3109 - Acer Incorporated)
Cramfire 2010 Version 2.9.2.3 (HKLM-x32\...\{8E49F657-FC83-4730-BF52-A69082989B8B}_is1) (Version:  - Creativteam Pangritz)
CyberLink MediaEspresso 6.5 (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 6.5.3318_45364 - CyberLink Corp.)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3318_45364 - CyberLink Corp.) Hidden
Delicious: Emily's True Love Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.63.5 - Electronic Arts)
Die Sims™ 3 Inselparadies (HKLM-x32\...\{DB21639E-FE55-432C-BCA2-0C5249E3F79E}) (Version: 19.0.101 - Electronic Arts)
Die Sims™ 3 Luxus-Accessoires (HKLM-x32\...\{71828142-5A24-4BD0-97E7-976DA08CE6CF}) (Version: 3.0.38 - Electronic Arts)
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.13 - Dolby Laboratories Inc)
Dritek Radio Controller (HKLM-x32\...\RadioController) (Version: 2.02.2001.0803 - Dritek System Inc.)
eBay Worldwide (HKLM-x32\...\{A694AF57-9891-4D62-824C-7E55A1361A14}) (Version: 2.3.0630 - OEM)
ETDWare PS/2-X64 11.6.16.003_WHQL (HKLM\...\Elantech) (Version: 11.6.16.003 - ELAN Microelectronic Corp.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.14) (Version: 9.14 - Artifex Software Inc.)
Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.3004 - Acer Incorporated)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3316 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.4.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 7.0.10 - Acer Inc.)
Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.3006 - Acer Incorporated)
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Media Go (HKLM-x32\...\{F66C4A41-C3A8-4523-AB6C-BAA1DB38305C}) (Version: 2.7.357 - Sony)
Media Go Network Downloader (HKLM-x32\...\{5562F05F-908C-4F15-9B3C-98D5FD32DCAB}) (Version: 1.5.19.0 - Sony)
Media Go Video Playback Engine 2.4.132.12090 (HKLM-x32\...\{7C5AEEE1-6D7C-8922-4548-7BF9096077EC}) (Version: 2.4.132.12090 - Sony)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0 - Microsoft Corporation) Hidden
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
MyWinLocker (Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.24 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.) Hidden
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.9013 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9013 - NTI Corporation) Hidden
NVIDIA Grafiktreiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.02 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.133.889 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.14.17 (Version: 1.14.17 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.12.0613 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.12.0613 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0613 - NVIDIA Corporation)
NVIDIA Systemsteuerung 327.02 (Version: 327.02 - NVIDIA Corporation) Hidden
NVIDIA Update 1.14.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.14.17 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.14.17 - NVIDIA Corporation) Hidden
Office Addin (HKLM-x32\...\{6D2BBE1D-E600-4695-BA37-0B0E605542CC}) (Version: 2.01.3202 - Acer)
Office Addin 2003 (HKLM-x32\...\{1FCC073B-CC01-4443-AD20-E559F66E6E83}) (Version: 2.01.3202 - Acer)
Origin (HKLM-x32\...\Origin) (Version: 8.4.1.210 - Electronic Arts, Inc.)
PDF24 Creator 6.4.1 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.214 - Qualcomm Atheros Communications)
Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 11.21 - Qualcomm Atheros)
R for Windows 3.0.2 (HKLM\...\R for Windows 3.0.2_is1) (Version: 3.0.2 - R Core Team)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Shopping Blocks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Snap.Do (HKLM-x32\...\{F4F6F37C-8D19-4DAD-BF7B-0953133FD43F}) (Version: 11.20.1.15636 - ReSoft Ltd.) <==== ATTENTION
Sony Mobile Update Engine (HKLM-x32\...\Update Engine) (Version: 2.14.8.201405281228 - Sony Mobile Communications AB)
Sony PC Companion 2.10.211 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.211 - Sony)
Spotify (HKLM-x32\...\Spotify) (Version: 0.8.4.99.ga249b5f1 - Spotify AB)
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VoiceOver Kit (HKLM-x32\...\{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}) (Version: 1.42.128.0 - Apple Inc.)
Vokabel Trainer 5 (HKLM-x32\...\{5E0D2061-86AB-4B83-A671-A0BF3FF1537B}_is1) (Version:  - Manuel Wäschle)
WildTangent-Spiele (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

22-07-2014 11:20:42 Geplanter Prüfpunkt
31-07-2014 11:29:35 Geplanter Prüfpunkt
06-08-2014 20:33:55 Installed Java 7 Update 67
08-08-2014 14:27:34 Avira Free Antivirus - 08.08.2014 16:27
12-08-2014 06:28:47 eBay Worldwide wird entfernt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B350D20-A675-41C5-85A9-D27862EBA789} - System32\Tasks\iuEmailOutlookAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe [2012-08-23] ()
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {31C54016-63C9-4A1E-98E5-886EBC7BB47D} - \a2zLyrics-16-updater No Task File <==== ATTENTION
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3558E594-835D-440C-BE23-F971D0D70EF1} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {374C3719-F7B0-4CA0-AC86-A417AF209DD0} - System32\Tasks\avgntfltavipbbavkmgr => C:\WINDOWS\UOINSTLMv7.EXE
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {3DA36C08-668B-4003-8655-9BA5D1ED0E1F} - \a2zLyrics-16-chromeinstaller No Task File <==== ATTENTION
Task: {464BB915-D7B3-4E38-B71E-60C070AA05F2} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {46A61AA1-FFD6-4F58-9417-59C0140706FB} - System32\Tasks\FF Watcher {1107A3EF-61B5-4AF4-8C49-16775FB0A1A7} => C:\Program Files\V-bates\PrefHelper.exe
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {4AC8B08D-B527-49D5-9DFF-AD3169366ABD} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2012-09-20] (CyberLink)
Task: {521FF5A1-FA4F-4838-AA7C-D083919EFFFE} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-11-06] ()
Task: {574FDE84-5898-4059-97F3-3E0E263B070E} - System32\Tasks\APSnotifierCA => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {580813B3-FEB5-4195-9E1E-10F701DB7A85} - \a2zLyrics-16-enabler No Task File <==== ATTENTION
Task: {5C8DC5F6-6784-4CAC-9EAA-C6C6C260F360} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-10-23] (Acer Incorporated)
Task: {5E2FC257-2E29-478E-9D8B-E2551FF818D8} - \a2zLyrics-16-codedownloader No Task File <==== ATTENTION
Task: {68C591A1-0346-45D9-9852-53F58C7300B7} - \FoxTab No Task File <==== ATTENTION
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6AF73DBF-0F28-4D8E-9913-162B9AC79410} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-23] (Google Inc.)
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {78855C47-6D41-4433-BD1D-889F461BC546} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {827B111E-DD01-4665-8852-D8707D9FD166} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-23] (Google Inc.)
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {8D8D8DC8-12B5-42A1-9978-70747734D13A} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-21] ()
Task: {99857588-E187-42E7-9792-131E61AB5EFD} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A7220801-FF0B-4DB1-B491-6A2D4D2899DF} - System32\Tasks\FileAssociationManagerUpdater => C:\Program Files (x86)\FileAssociationManager\Updater.exe
Task: {AB407D31-3406-4419-B424-703A519A04E0} - System32\Tasks\iuBrowserIEAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe [2012-08-23] ()
Task: {B10E85E7-137B-471B-8FAF-D74AA64FCC30} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-07-12] (Microsoft Corporation)
Task: {BDB0AD9D-F6C4-496A-9704-F7FA985D8E50} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {C775C7F8-3892-45DE-B221-67E250ED6930} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA057EB1-382E-4978-B34E-DA9C61E16888} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E15B4CD7-0F0A-432E-8F78-96244B972DA1} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {E16462A9-833E-4FEC-AF67-A21760B293F6} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {EF99D8E2-00EB-4096-84E1-C639C645BBF0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {F19DE44C-1993-4C51-8962-BAFA6946A7E8} - \CreateChoiceProcessTask No Task File <==== ATTENTION
Task: C:\WINDOWS\Tasks\APSnotifierCA.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\FF Watcher {1107A3EF-61B5-4AF4-8C49-16775FB0A1A7}.job => C:\Program Files\V-bates\PrefHelper.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 02:36 - 2013-09-05 02:36 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2012-06-22 04:12 - 2012-06-22 04:12 - 01407568 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-03-04 12:49 - 2011-03-04 12:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2012-11-03 02:38 - 2012-11-03 02:38 - 00465384 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-11-03 02:37 - 2012-11-03 02:37 - 00125504 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2012-11-03 02:38 - 2012-11-03 02:38 - 00155712 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\VolumeSnapshot.dll
2012-11-03 02:37 - 2012-11-03 02:37 - 00118336 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\Online.dll
2012-11-03 02:37 - 2012-11-03 02:37 - 01081408 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-11-03 02:37 - 2012-11-03 02:37 - 00052288 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OsSettingPort.dll
2012-11-03 02:37 - 2012-11-03 02:37 - 00727616 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OutlookShadow.dll
2013-03-12 07:17 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-08-07 08:49 - 2014-07-14 16:49 - 00049744 _____ () C:\Users\Jutta\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-07-24 11:50 - 2014-07-24 11:50 - 00137296 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-07-24 11:49 - 2014-07-24 11:49 - 00065104 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-08-08 18:07 - 2014-08-08 18:07 - 00012288 _____ () C:\Program Files (x86)\Google\Chrome\Application\WTSAPI32.dll
2014-07-20 11:54 - 2014-07-15 11:24 - 00718664 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\libglesv2.dll
2014-07-20 11:54 - 2014-07-15 11:24 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\libegl.dll
2014-07-20 11:54 - 2014-07-15 11:24 - 08537928 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\pdf.dll
2014-07-20 11:54 - 2014-07-15 11:24 - 00353096 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll
2014-07-20 11:54 - 2014-07-15 11:24 - 01732936 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ffmpegsumo.dll
2014-07-20 11:54 - 2014-07-15 11:24 - 14664008 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Jutta\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "CanonQuickMenu"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"

==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/12/2014 09:03:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.532, Zeitstempel: 0x53518532
Name des fehlerhaften Moduls: mbamcore.dll, Version: 1.0.11.0, Zeitstempel: 0x536d8027
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00037cce
ID des fehlerhaften Prozesses: 0x1ed8
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3
Vollständiger Name des fehlerhaften Pakets: mbam.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbam.exe5

Error: (08/12/2014 08:38:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: adwcleaner_3.304.exe, Version: 3.3.0.4, Zeitstempel: 0x4f25baec
Name des fehlerhaften Moduls: adwcleaner_3.304.exe, Version: 3.3.0.4, Zeitstempel: 0x4f25baec
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000111c9
ID des fehlerhaften Prozesses: 0x3edc
Startzeit der fehlerhaften Anwendung: 0xadwcleaner_3.304.exe0
Pfad der fehlerhaften Anwendung: adwcleaner_3.304.exe1
Pfad des fehlerhaften Moduls: adwcleaner_3.304.exe2
Berichtskennung: adwcleaner_3.304.exe3
Vollständiger Name des fehlerhaften Pakets: adwcleaner_3.304.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: adwcleaner_3.304.exe5

Error: (08/12/2014 08:37:16 AM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: There was an error with the Windows Location Provider database

Error: (08/12/2014 08:33:30 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: adwcleaner_3.304.exe, Version: 3.3.0.4, Zeitstempel: 0x4f25baec
Name des fehlerhaften Moduls: adwcleaner_3.304.exe, Version: 3.3.0.4, Zeitstempel: 0x4f25baec
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000111c9
ID des fehlerhaften Prozesses: 0x3dd4
Startzeit der fehlerhaften Anwendung: 0xadwcleaner_3.304.exe0
Pfad der fehlerhaften Anwendung: adwcleaner_3.304.exe1
Pfad des fehlerhaften Moduls: adwcleaner_3.304.exe2
Berichtskennung: adwcleaner_3.304.exe3
Vollständiger Name des fehlerhaften Pakets: adwcleaner_3.304.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: adwcleaner_3.304.exe5

Error: (08/11/2014 11:17:54 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1109

Error: (08/11/2014 11:17:54 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1109

Error: (08/11/2014 11:17:54 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/11/2014 08:44:57 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20573 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 3aec

Startzeit: 01cfb52fb365513d

Endzeit: 4294967295

Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20573_x64__8wekyb3d8bbwe\LiveComm.exe

Berichts-ID: f42060ae-2122-11e4-be90-208984642363

Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20573_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1

Error: (08/11/2014 08:44:49 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: JUTTAPC)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (08/10/2014 11:49:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4766


System errors:
=============
Error: (08/11/2014 08:44:49 AM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (08/09/2014 11:04:14 AM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (08/06/2014 08:31:14 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.0.105
registriert werden. Der Computer mit IP-Adresse 192.168.0.103 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (08/06/2014 08:49:21 AM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (08/02/2014 00:30:20 PM) (Source: DCOM) (EventID: 10016) (User: JUTTAPC)
Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}JuttaPCJuttaS-1-5-21-1768041208-787304100-1710538151-1002LocalHost (unter Verwendung von LRPC)Microsoft.BingNews_3.0.2.309_x64__8wekyb3d8bbweS-1-15-2-508114518-3340871649-811464485-526616082-4258465299-1774086546-1865468257

Error: (07/22/2014 08:07:15 PM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (07/21/2014 07:44:35 PM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (07/18/2014 10:39:18 PM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (07/18/2014 10:38:28 PM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (07/15/2014 04:11:18 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "DANIEL-PC",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{6A596D42-49BA-4B9C-8AE9-8F5241ED4BE8}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.


Microsoft Office Sessions:
=========================
Error: (02/08/2014 11:26:38 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6690.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 12 seconds with 0 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Percentage of memory in use: 29%
Total physical RAM: 8007.27 MB
Available physical RAM: 5658.84 MB
Total Pagefile: 16199.27 MB
Available Pagefile: 13531.9 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:911.85 GB) (Free:785.87 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 34952447)

Partition: GPT Partition Type.

==================== End Of Log ============================

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-20 18:04:56
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000036 TOSHIBA_MQ01ABD100 rev.AX003J 931,51GB
Running: wq91hk15.exe; Driver: C:\Users\Jutta\AppData\Local\Temp\kwldypow.sys


---- Kernel code sections - GMER 2.1 ----

.text   C:\WINDOWS\System32\win32k.sys!W32pServiceTable                                               fffff960000ee300 15 bytes [00, F7, F7, 01, 80, D7, 70, ...]
.text   C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16                                          fffff960000ee310 11 bytes [00, 99, FC, FF, 00, C1, C3, ...]

---- User code sections - GMER 2.1 ----

.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation   00007ffee70928c0 7 bytes JMP 00007fffe48302d0
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW          00007ffee70943d8 7 bytes JMP 00007fffe4830308
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA            00007ffee7141f20 7 bytes JMP 00007fffe4830378
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW            00007ffee71440b4 7 bytes JMP 00007fffe48303b0
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW           00007ffee7144510 7 bytes JMP 00007fffe4830340
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleFileNameExW   00007ffee7144af0 7 bytes JMP 00007fffe4830260
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx   00007ffee716cea0 7 bytes JMP 00007fffe4830228
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW     00007ffee716cf10 7 bytes JMP 00007fffe4830298
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW        00007ffee4842300 7 bytes JMP 00007fffe48300d8
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary             00007ffee4845770 5 bytes JMP 00007fffe4830180
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW          00007ffee4845860 5 bytes JMP 00007fffe4830148
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW      00007ffee4845a30 5 bytes JMP 00007fffe4830110
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\USER32.dll!CreateWindowExW             00007ffee6f1b6f4 10 bytes JMP 00007fffe4830490
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW         00007ffee6f245d8 5 bytes JMP 00007fffe4830458
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo  00007ffee6f24750 9 bytes JMP 00007fffe48303e8
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA         00007ffee6f34fc0 5 bytes JMP 00007fffe4830420
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList     00007ffee5501500 8 bytes JMP 00007fffe48301b8
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo       00007ffee5501750 8 bytes JMP 00007fffe48301f0
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\System32\dxgi.dll!CreateDXGIFactory1            00007ffee03f7a88 5 bytes JMP 00007fffe03e0110
.text   C:\WINDOWS\System32\dwm.exe[10628] C:\WINDOWS\System32\dxgi.dll!CreateDXGIFactory             00007ffee0404990 5 bytes JMP 00007fffe03e00d8

---- Threads - GMER 2.1 ----

Thread  C:\WINDOWS\system32\csrss.exe [7788:8612]                                                     fffff96000935b90

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                         unknown MBR code

---- EOF - GMER 2.1 ----

JuttaS. · 21.08.2014, 10:35

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 21.08.2014
Scan Time: 11:08:59
Logfile: malwarebytes.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.12.03
Rootkit Database: v2014.08.04.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Jutta

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 366868
Time Elapsed: 19 min, 57 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 29
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\CLASSES\CLSID\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{E7BF74EE-9106-4113-B216-2F980BA29141}, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{F2DB3739-77FB-41EB-9ED3-ABF34DF2DBF7}, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{F2DB3739-77FB-41EB-9ED3-ABF34DF2DBF7}, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{E7BF74EE-9106-4113-B216-2F980BA29141}, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\CLASSES\DPBHO.DownloadProtect.1, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\CLASSES\DPBHO.DownloadProtect, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\DPBHO.DownloadProtect, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\DPBHO.DownloadProtect.1, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\CLASSES\CLSID\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}\INPROCSERVER32, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\CLSID\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}, , [e8cb8e378cef50e6206d97d66d95827e], 
PUP.Optional.VBates, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}, , [e8cb8e378cef50e6206d97d66d95827e], 
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}, , [e8cb8e378cef50e6206d97d66d95827e], 
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}, , [e8cb8e378cef50e6206d97d66d95827e], 
PUP.Optional.VBates, HKU\S-1-5-21-1768041208-787304100-1710538151-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}, , [e8cb8e378cef50e6206d97d66d95827e], 
PUP.Optional.VBates, HKU\S-1-5-21-1768041208-787304100-1710538151-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}, , [e8cb8e378cef50e6206d97d66d95827e], 
PUP.Optional.GetNow.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}, , [674c4c79681370c670aa620c2cd6f10f], 
PUP.Optional.GetNow.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{237FDFDB-3722-470E-8BA8-90196DABE967}, , [674c4c79681370c670aa620c2cd6f10f], 
PUP.Optional.GetNow.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{237FDFDB-3722-470E-8BA8-90196DABE967}, , [674c4c79681370c670aa620c2cd6f10f], 
PUP.Optional.GetNow.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}, , [674c4c79681370c670aa620c2cd6f10f], 
PUP.Optional.Snapdo.T, HKU\S-1-5-21-1768041208-787304100-1710538151-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, , [0aa9794c0378ab8bc3b5257f17eb27d9], 
PUP.Optional.VbatesHelper.A, HKLM\SOFTWARE\V-bates, , [1f9406bf2b501d196da9d236f90ad42c], 
PUP.Optional.Awesomehp.A, HKLM\SOFTWARE\WOW6432NODE\awesomehpSoftware, , [42718e3790ebbd79afaf659ec142c937], 
PUP.Optional.VbatesHelper.A, HKLM\SOFTWARE\WOW6432NODE\V-bates, , [9e15616492e9d660779f21e7659e09f7], 
PUP.Optional.QuickStart.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\pelmeidfhdlhlbjimpabfcbnnojbboma, , [664d23a2354653e3c4eb19e1867cdd23], 
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-1768041208-787304100-1710538151-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Search-Protect, , [0ca7dee79be08da962192ab3c042847c], 

Registry Values: 2
PUP.Optional.DownloadProtect.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Download Protect, C:\ProgramData\dlprotect.exe, , [882b3c89f2896cca14ad8db1a3618878]
PUP.Optional.QuickStart.A, HKU\S-1-5-21-1768041208-787304100-1710538151-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, quick_start@gmail.com, , [20937451bdbec274dfed3ca8659dd62a]

Registry Data: 7
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[cae98f36562562d45bfa8942c83cf10f]
PUP.Optional.Snapdo, HKU\S-1-5-21-1768041208-787304100-1710538151-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgF6Mka1G3uKuOnWXU9AmkzoRRwLU2QQbRfCFN6Uu6h8pOahpBWOdYoodrWH6V4YS1LjQ1SsNYw8DBY1VnEBlxcH9BktbRw51ftbDDXqDhe0cIoLASioH0XIXlEEWh_xh&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgF6Mka1G3uKuOnWXU9AmkzoRRwLU2QQbRfCFN6Uu6h8pOahpBWOdYoodrWH6V4YS1LjQ1SsNYw8DBY1VnEBlxcH9BktbRw51ftbDDXqDhe0cIoLASioH0XIXlEEWh_xh&q={searchTerms}),,[a80b4382611a2b0beed9a2285da7e818]
PUP.Optional.Snapdo, HKU\S-1-5-21-1768041208-787304100-1710538151-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgF6Mka1G3uKuOnWXU9AmkzoRRwLU2QQbRfCFN6Uu6h8pOahpBWOdYoodrWH6V4YS1LR6Oj9S9_teRcAnqV09Bn6zlhE7-RB1BwDkWXv2hnfTBKUfX3HZYbbgVnyXVRNc, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgF6Mka1G3uKuOnWXU9AmkzoRRwLU2QQbRfCFN6Uu6h8pOahpBWOdYoodrWH6V4YS1LR6Oj9S9_teRcAnqV09Bn6zlhE7-RB1BwDkWXv2hnfTBKUfX3HZYbbgVnyXVRNc),,[e9ca1ca991ea6fc70abe408abb49d42c]
PUP.Optional.Snapdo, HKU\S-1-5-21-1768041208-787304100-1710538151-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgF6Mka1G3uKuOnWXU9AmkzoRRwLU2QQbRfCFN6Uu6h8pOahpBWOdYoodrWH6V4YS1LjQ1SsNYw8DBY1VnEBlxcH9BktbRw51ftbDDXqDhe0cIoLASioH0XIXlEEWh_xh&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgF6Mka1G3uKuOnWXU9AmkzoRRwLU2QQbRfCFN6Uu6h8pOahpBWOdYoodrWH6V4YS1LjQ1SsNYw8DBY1VnEBlxcH9BktbRw51ftbDDXqDhe0cIoLASioH0XIXlEEWh_xh&q={searchTerms}),,[b5fea025f18ae84e6e58f1d9c53f37c9]
PUP.Optional.Snapdo, HKU\S-1-5-21-1768041208-787304100-1710538151-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgF6Mka1G3uKuOnWXU9AmkzoRRwLU2QQbRfCFN6Uu6h8pOahpBWOdYoodrWH6V4YS1LjQ1SsNYw8DBY1VnEBlxcH9BktbRw51ftbDDXqDhe0cIoLASioH0XIXlEEWh_xh&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgF6Mka1G3uKuOnWXU9AmkzoRRwLU2QQbRfCFN6Uu6h8pOahpBWOdYoodrWH6V4YS1LjQ1SsNYw8DBY1VnEBlxcH9BktbRw51ftbDDXqDhe0cIoLASioH0XIXlEEWh_xh&q={searchTerms}),,[e6cd0bbaff7c8aac39906b5fc53f60a0]
PUP.Optional.Snapdo, HKU\S-1-5-21-1768041208-787304100-1710538151-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgF6Mka1G3uKuOnWXU9AmkzoRRwLU2QQbRfCFN6Uu6h8pOahpBWOdYoodrWH6V4YS1LjQ1SsNYw8DBY1VnEBlxcH9BktbRw51ftbDDXqDhe0cIoLASioH0XIXlEEWh_xh&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgF6Mka1G3uKuOnWXU9AmkzoRRwLU2QQbRfCFN6Uu6h8pOahpBWOdYoodrWH6V4YS1LjQ1SsNYw8DBY1VnEBlxcH9BktbRw51ftbDDXqDhe0cIoLASioH0XIXlEEWh_xh&q={searchTerms}),,[714206bf3d3e49ed408a963453b16b95]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-1768041208-787304100-1710538151-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgF6Mka1G3uKuOnWXU9AmkzoRRwLU2QQbRfCFN6Uu6h8pOahpBWOdYoodrWH6V4YS1LjQ1SsNYw8DBY1VnEBlxcH9BktbRw51ftbDDXqDhe0cIoLASioH0XIXlEEWh_xh&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgF6Mka1G3uKuOnWXU9AmkzoRRwLU2QQbRfCFN6Uu6h8pOahpBWOdYoodrWH6V4YS1LjQ1SsNYw8DBY1VnEBlxcH9BktbRw51ftbDDXqDhe0cIoLASioH0XIXlEEWh_xh&q={searchTerms}),,[842f19ac8fec3bfbd092f6cbd92b30d0]

Folders: 4
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Configs, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Resources, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.CrossRider.A, C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dfocabhmkfcdibnkgogpaclhgblhnemn, , [f8bbaa1bcbb066d0fd9f34931ee432ce], 

Files: 61
PUP.Optional.DownloadProtect.A, C:\Program Files\{52FDD8FE-3A05-46AD-8979-5A27549A00E1}\{A7B47E33-CC92-4407-BC47-2B4408247076}.bin, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.DownloadProtect.A, C:\Program Files (x86)\{CD2E1139-AB81-4B2D-8D67-FFC2FF92E021}\{F03F9CF9-D5BC-4673-85E2-83AA340278DD}.bin, , [7b3811b46417e74fe8b06de079876799], 
PUP.Optional.Babylon.A, C:\$Recycle.Bin\S-1-5-21-1768041208-787304100-1710538151-1002\$R5VSM5G.exe, , [0ea565601764bd79eacc1bf55ba6b848], 
PUP.Optional.ScramblePacker.A, C:\Users\Jutta\AppData\Local\Temp\a2zLyrics_1060-8102_v122.exe, , [456ebb0aadceff37dcf15c2a7f8215eb], 
PUP.Optional.Somoto.A, C:\Users\Jutta\AppData\Local\Temp\appshat-distribution.exe, , [bbf8972e087382b4172fc161cb35c43c], 
PUP.Optional.Somoto, C:\Users\Jutta\AppData\Local\Temp\UpdateCheckerSetup.exe, , [2093dee7e39846f0cd4a37f03ec2da26], 
PUP.Optional.MoviesToolBar.A, C:\Users\Jutta\AppData\Local\Temp\MoviesToolbarSetup_Somoto_9_10_2013.exe, , [8c278243b4c742f407616cbb6e9348b8], 
PUP.Optional.Spigot.A, C:\Users\Jutta\AppData\Local\Temp\nsa21AD.tmp-2\APN_ATU3_.exe, , [82319b2ab4c7171f50341d1240c1e21e], 
PUP.Optional.Spigot.A, C:\Users\Jutta\AppData\Local\Temp\nsf5F1.tmp-2\APN_ATU3_.exe, , [1c97cdf88dee3501552f929df40dba46], 
PUP.Optional.SkyTech.A, C:\Users\Jutta\AppData\Local\Temp\fullpackage_temp1394025218\package1.zip, , [d4dfe1e4700bae88ec4e5ed4d32d6f91], 
PUP.Optional.SkyTech.A, C:\Users\Jutta\AppData\Local\Temp\fullpackage_temp1394025218\QQBrowserFrame.dll, , [971c863f91ea54e2fa4091a18977be42], 
PUP.Optional.SupTab.A, C:\Users\Jutta\AppData\Local\Temp\fullpackage_temp1394025218\tmp\SupTab.exe, , [2f840bba9ae1d6602050b87dfe02f010], 
PUP.Optional.WpManager, C:\Users\Jutta\AppData\Local\Temp\fullpackage_temp1394025218\tmp\wpm.exe, , [8b28854098e37bbbb5ee096208f97987], 
PUP.Optional.RegCleanerPro, C:\Users\Jutta\AppData\Local\Temp\is1233253943\174199489_stp\rcpsetup_adppi_adppi.exe, , [991a428383f844f22e8815008f726d93], 
PUP.Optional.BatBrowse.A, C:\Users\Jutta\AppData\Local\Temp\is1233253943\174199527_stp\BatBrowseSetup.exe, , [0ea5c4018af19e9880421631c440c43c], 
PUP.Optional.BonanzaDeals.A, C:\Users\Jutta\AppData\Local\Temp\is1233253943\174199610_stp\bd.exe, , [e2d13f86314a1224cfc260cd748da35d], 
PUP.Optional.SnapDo.A, C:\Windows\Installer\8a05b5b.msi, , [951eb5107605c96de099058981808f71], 
PUP.Optional.VBates, C:\Windows\System32\Tasks\FF Watcher {1107A3EF-61B5-4AF4-8C49-16775FB0A1A7}, , [1e95695c7cff54e23d0c4693fd0512ee], 
PUP.Optional.VBates, C:\Windows\Tasks\FF Watcher {1107A3EF-61B5-4AF4-8C49-16775FB0A1A7}.job, , [0fa4b4118dee5dd924262cad4ab8639d], 
PUP.Optional.Superfish.A, C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, , [a40fb90c0a71d26488e510de41c19b65], 
PUP.Optional.Superfish.A, C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, , [42711baaa9d245f1165716d89270f907], 
PUP.Optional.QuickStart.A, C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx, , [b5fe764fb3c874c2cf1119df57ab27d9], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\PublisherSettings.xml, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\FiddlerCore.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\HtmlAgilityPack.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\linmsl.exe, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\LPTInstaller.msi, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\lrrot.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\NewConfig.txt, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Newtonsoft.Json.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Smartbar.Common.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Smartbar.Communication.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Smartbar.Communication.NamedPipe.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Smartbar.Infrastructure.Utilities.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Smartbar.Monetization.Proxy.ProxyRemover.exe, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Smartbar.Monetization.Proxy.ProxyService.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Smartbar.Personalization.Common.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Smartbar.Resources.HistoryAndStatsWrapper.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\sppsm.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\spusm.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\srbs.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\srbu.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\sreu.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\srpdm.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\srprl.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\srpt.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\srptc.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\srptm.exe, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\srptm.exe.config, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\srut.dll, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\UserSettings.xml, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\XMLOperations.xml, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Configs\BrowserSettings.xml, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Configs\LPTMapping.xml, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Configs\Timers.xml, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.Linkury.A, C:\Users\Jutta\AppData\Local\LPT\Resources\LPT.xml, , [e8cbd9ec4c2fc472a3ffee128a794fb1], 
PUP.Optional.DownloadProtect.A, C:\ProgramData\dlprotect.exe, , [882b3c89f2896cca14ad8db1a3618878], 
PUP.Optional.CrossRider.A, C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dfocabhmkfcdibnkgogpaclhgblhnemn\000040.sst, , [f8bbaa1bcbb066d0fd9f34931ee432ce], 
PUP.Optional.CrossRider.A, C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dfocabhmkfcdibnkgogpaclhgblhnemn\000042.sst, , [f8bbaa1bcbb066d0fd9f34931ee432ce], 
PUP.Optional.CrossRider.A, C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dfocabhmkfcdibnkgogpaclhgblhnemn\000051.sst, , [f8bbaa1bcbb066d0fd9f34931ee432ce], 
PUP.Optional.CrossRider.A, C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dfocabhmkfcdibnkgogpaclhgblhnemn\LOG.old, , [f8bbaa1bcbb066d0fd9f34931ee432ce], 

Physical Sectors: 0
(No malicious items detected)


(end)

Bootsektor · 21.08.2014, 23:33

Hallo,

danke schön

Downloadprotect ist hartnäckig, das stimmt.

Schritt 1
Bitte deinstalliere folgende Programme:

Snap.Do

Dazu drücke auf:
Windowstaste und X
dann:
Programme und Funktionen --> Programm auswählen --> entfernen

Falls du ein Programm nicht deinstallieren kannst, lade dir von hier den Revo-uninstaller herunter und deinstalliere es damit, wähle dabei den moderaten Modus.

Schritt 2
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 3
Starte noch einmal FRST.

Setze den Haken bei addition.txt und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.

JuttaS. · 22.08.2014, 09:59

Nach dem AdwCleaner Scan wurde nur "Intel(R) HID UAC-Dateivirtualisierung" gefunden. Soll ich das wirklich löschen oder ist das nicht wichtig für irgendwas?

Bootsektor · 22.08.2014, 12:17

Und das war auch wirklich der Adwarecleaner, der das gefunden hat und nichts weiteres?

Kannst du bitte das Suchlog posten?

JuttaS. · 22.08.2014, 15:32

Code:

ATTFilter

# AdwCleaner v3.308 - Bericht erstellt am 22/08/2014 um 16:31:33
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Jutta - JUTTAPC
# Gestartet von : C:\Users\Jutta\Desktop\adwcleaner_3.308.exe
# Option : Suchen

***** [ Dienste ] *****

Dienst Gefunden : tzutil64

***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\ProgramData\dlprotect.exe
Datei Gefunden : C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx
Datei Gefunden : C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gefunden : C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
Datei Gefunden : C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\3ecsef88.default\user.js
Datei Gefunden : C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\zsdyt9r2.default\user.js
Datei Gefunden : C:\WINDOWS\System32\DlProtectSvc.exe
Datei Gefunden : C:\WINDOWS\System32\KBEUGHR1.exe
Ordner Gefunden : C:\Program Files (x86)\{CD2E1139-AB81-4B2D-8D67-FFC2FF92E021}
Ordner Gefunden : C:\Program Files\{52FDD8FE-3A05-46AD-8979-5A27549A00E1}
Ordner Gefunden : C:\Users\Jutta\AppData\Local\LPT
Ordner Gefunden : C:\Users\Jutta\AppData\Local\Software
Ordner Gefunden : C:\Users\Jutta\AppData\Local\Temp\OCS
Ordner Gefunden : C:\WINDOWS\Installer\{04DDB23B-E880-4DB1-A3CF-748D8C190CD2}

***** [ Tasks ] *****

Task Gefunden : APSnotifierCA
Task Gefunden : FoxTab
Task Gefunden : FF Watcher {1107A3EF-61B5-4AF4-8C49-16775FB0A1A7}

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\AnyProtect
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : HKCU\Software\SmartBar
Schlüssel Gefunden : [x64] HKCU\Software\AnyProtect
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\SmartBar
Schlüssel Gefunden : HKLM\SOFTWARE\awesomehpSoftware
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}
Schlüssel Gefunden : HKLM\SOFTWARE\CLASSES\DPBHO.DownloadProtect
Schlüssel Gefunden : HKLM\SOFTWARE\CLASSES\DPBHO.DownloadProtect.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F2DB3739-77FB-41EB-9ED3-ABF34DF2DBF7}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{E7BF74EE-9106-4113-B216-2F980BA29141}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F4F6F37C-8D19-4DAD-BF7B-0953133FD43F}
Schlüssel Gefunden : HKLM\SOFTWARE\V-bates
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{F2DB3739-77FB-41EB-9ED3-ABF34DF2DBF7}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\V-bates
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Download Protect]
Wert Gefunden : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{4E56F93F-FF1A-4576-BC0A-8FDACA66E229}]

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\3ecsef88.default\prefs.js ]


[ Datei : C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\zsdyt9r2.default\prefs.js ]


-\\ Google Chrome v36.0.1985.143

[ Datei : C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gefunden [Extension] : dchmpbaclbiioedakpcldenooikekokm
Gefunden [Extension] : pelmeidfhdlhlbjimpabfcbnnojbboma

*************************

AdwCleaner[R0].txt - [4762 octets] - [26/10/2013 18:36:51]
AdwCleaner[R1].txt - [14509 octets] - [29/10/2013 22:31:42]
AdwCleaner[R2].txt - [7626 octets] - [29/10/2013 22:32:25]
AdwCleaner[R3].txt - [6584 octets] - [12/08/2014 08:37:56]
AdwCleaner[R4].txt - [6549 octets] - [12/08/2014 09:27:29]
AdwCleaner[R5].txt - [7190 octets] - [22/08/2014 10:53:10]
AdwCleaner[R6].txt - [6811 octets] - [22/08/2014 16:31:33]
AdwCleaner[S0].txt - [4438 octets] - [26/10/2013 18:37:33]
AdwCleaner[S1].txt - [10576 octets] - [19/03/2014 14:52:17]
AdwCleaner[S2].txt - [295 octets] - [12/08/2014 08:33:28]
AdwCleaner[S3].txt - [406 octets] - [12/08/2014 08:38:27]

########## EOF - C:\AdwCleaner\AdwCleaner[R6].txt - [7110 octets] ##########

Bootsektor · 22.08.2014, 21:23

Ok, dann bitte alles löschen lassen und ein neues Log von FRST, hake das Feld addition.txt an.

JuttaS. · 23.08.2014, 11:11

Code:

ATTFilter

# AdwCleaner v3.308 - Bericht erstellt am 23/08/2014 um 11:57:05
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Jutta - JUTTAPC
# Gestartet von : C:\Users\Jutta\Desktop\adwcleaner_3.308.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : tzutil64

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\{CD2E1139-AB81-4B2D-8D67-FFC2FF92E021}
Ordner Gelöscht : C:\WINDOWS\Installer\{04DDB23B-E880-4DB1-A3CF-748D8C190CD2}
Ordner Gelöscht : C:\Program Files\{52FDD8FE-3A05-46AD-8979-5A27549A00E1}
Ordner Gelöscht : C:\Users\Jutta\AppData\Local\LPT
Ordner Gelöscht : C:\Users\Jutta\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Jutta\AppData\Local\Software
Datei Gelöscht : C:\ProgramData\dlprotect.exe
Datei Gelöscht : C:\WINDOWS\System32\DlProtectSvc.exe
Datei Gelöscht : C:\WINDOWS\System32\KBEUGHR1.exe
Datei Gelöscht : C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\3ecsef88.default\user.js
Datei Gelöscht : C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\zsdyt9r2.default\user.js
Datei Gelöscht : C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx
Datei Gelöscht : C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

***** [ Tasks ] *****

Task Gelöscht : APSnotifierCA
Task Gelöscht : FoxTab
Task Gelöscht : FF Watcher {1107A3EF-61B5-4AF4-8C49-16775FB0A1A7}

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{4E56F93F-FF1A-4576-BC0A-8FDACA66E229}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma
Schlüssel Gelöscht : HKLM\SOFTWARE\CLASSES\DPBHO.DownloadProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\CLASSES\DPBHO.DownloadProtect.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Download Protect]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F2DB3739-77FB-41EB-9ED3-ABF34DF2DBF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E7BF74EE-9106-4113-B216-2F980BA29141}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F2DB3739-77FB-41EB-9ED3-ABF34DF2DBF7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C654F3FE-8E84-4BB7-87CF-8D9171FC3C73}
Schlüssel Gelöscht : HKCU\Software\AnyProtect
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKLM\SOFTWARE\awesomehpSoftware
Schlüssel Gelöscht : HKLM\SOFTWARE\V-bates
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F4F6F37C-8D19-4DAD-BF7B-0953133FD43F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\V-bates
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\3ecsef88.default\prefs.js ]


[ Datei : C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\zsdyt9r2.default\prefs.js ]


-\\ Google Chrome v36.0.1985.143

[ Datei : C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Extension] : dchmpbaclbiioedakpcldenooikekokm
Gelöscht [Extension] : pelmeidfhdlhlbjimpabfcbnnojbboma

*************************

AdwCleaner[R0].txt - [4762 octets] - [26/10/2013 18:36:51]
AdwCleaner[R1].txt - [14509 octets] - [29/10/2013 22:31:42]
AdwCleaner[R2].txt - [7626 octets] - [29/10/2013 22:32:25]
AdwCleaner[R3].txt - [6584 octets] - [12/08/2014 08:37:56]
AdwCleaner[R4].txt - [6549 octets] - [12/08/2014 09:27:29]
AdwCleaner[R5].txt - [7190 octets] - [22/08/2014 10:53:10]
AdwCleaner[R6].txt - [7250 octets] - [22/08/2014 16:31:33]
AdwCleaner[R7].txt - [7310 octets] - [23/08/2014 11:31:51]
AdwCleaner[R8].txt - [7429 octets] - [23/08/2014 11:55:24]
AdwCleaner[S0].txt - [4438 octets] - [26/10/2013 18:37:33]
AdwCleaner[S1].txt - [10576 octets] - [19/03/2014 14:52:17]
AdwCleaner[S2].txt - [295 octets] - [12/08/2014 08:33:28]
AdwCleaner[S3].txt - [406 octets] - [12/08/2014 08:38:27]
AdwCleaner[S4].txt - [293 octets] - [23/08/2014 11:54:36]
AdwCleaner[S5].txt - [7156 octets] - [23/08/2014 11:57:05]

########## EOF - C:\AdwCleaner\AdwCleaner[S5].txt - [7216 octets] ##########

Bei FRST kam nur das

Code:

ATTFilter

LastRegBack: 2014-08-16 21:42

==================== End Of Log ============================

Und bei Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-08-2014
Ran by Jutta at 2014-08-23 12:07:38
Running from C:\Users\Jutta\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 clear.fi SDK - Video 2 (x32 Version: 2.1.2128 - CyberLink Corp.) Hidden
 clear.fi SDK- Movie 2 (x32 Version: 2.1.2112 - CyberLink Corp.) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{9DDDF20E-9FD1-4434-A43E-E7889DBC9420}) (Version: 4.0.0.0071 - NTI Corporation)
Acer Device Fast-lane (HKLM\...\{3F62D2FD-13C1-49A2-8B5D-47623D9460D7}) (Version: 1.00.3011 - Acer Incorporated)
Acer Instant Update Service (HKLM\...\{8215A318-CC27-435E-B3EA-2E3443C8998C}) (Version: 1.00.3013 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3011 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3012 - Acer Incorporated)
AcerCloud (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 2.01.3125 - Acer Incorporated)
AcerCloud Docs (HKLM-x32\...\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.00.3204 - Acer Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
aTube Catcher (HKLM-x32\...\aTube Catcher) (Version: 3.8.7943 - DsNET Corp)
Avira (HKLM-x32\...\{9590977b-7b6f-467e-a11a-efa1fae804da}) (Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
Backup Manager v4 (x32 Version: 4.0.0.0071 - NTI Corporation) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom Card Reader Driver Installer (HKLM\...\{F0A7DF2F-0BE0-470F-B137-D7A19F977189}) (Version: 15.4.7.1 - Broadcom Corporation)
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.3.5.0 - Canon Inc.)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.0 - Canon Inc.)
Canon iP7200 series Benutzerregistrierung (HKLM-x32\...\Canon iP7200 series Benutzerregistrierung) (Version:  - Canon Inc.‎)
Canon iP7200 series On-screen Manual (HKLM-x32\...\Canon iP7200 series On-screen Manual) (Version: 7.5.0 - Canon Inc.)
Canon iP7200 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP7200_series) (Version:  - Canon Inc.)
Canon MG5200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series) (Version:  - )
Canon MX880 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX880_series) (Version:  - )
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 1.0.0 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 1.0.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.0.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.3.0.15 - Swiss Academic Software)
clear.fi Media (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.01.3112 - Acer Incorporated)
clear.fi Photo (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 2.01.3109 - Acer Incorporated)
Cramfire 2010 Version 2.9.2.3 (HKLM-x32\...\{8E49F657-FC83-4730-BF52-A69082989B8B}_is1) (Version:  - Creativteam Pangritz)
CyberLink MediaEspresso 6.5 (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 6.5.3318_45364 - CyberLink Corp.)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3318_45364 - CyberLink Corp.) Hidden
Delicious: Emily's True Love Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.63.5 - Electronic Arts)
Die Sims™ 3 Inselparadies (HKLM-x32\...\{DB21639E-FE55-432C-BCA2-0C5249E3F79E}) (Version: 19.0.101 - Electronic Arts)
Die Sims™ 3 Luxus-Accessoires (HKLM-x32\...\{71828142-5A24-4BD0-97E7-976DA08CE6CF}) (Version: 3.0.38 - Electronic Arts)
Die Sims™ 4 Erstelle einen Sim-Demo (HKLM-x32\...\{6908ED99-F02B-4E99-A202-3FAC99C510ED}) (Version: 1.0.233.190 - Electronic Arts Inc.)
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.13 - Dolby Laboratories Inc)
Dritek Radio Controller (HKLM-x32\...\RadioController) (Version: 2.02.2001.0803 - Dritek System Inc.)
eBay Worldwide (HKLM-x32\...\{A694AF57-9891-4D62-824C-7E55A1361A14}) (Version: 2.3.0630 - OEM)
ETDWare PS/2-X64 11.6.16.003_WHQL (HKLM\...\Elantech) (Version: 11.6.16.003 - ELAN Microelectronic Corp.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.14) (Version: 9.14 - Artifex Software Inc.)
Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.3004 - Acer Incorporated)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3316 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.4.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 7.0.10 - Acer Inc.)
Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.3006 - Acer Incorporated)
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Media Go (HKLM-x32\...\{F66C4A41-C3A8-4523-AB6C-BAA1DB38305C}) (Version: 2.7.357 - Sony)
Media Go Network Downloader (HKLM-x32\...\{5562F05F-908C-4F15-9B3C-98D5FD32DCAB}) (Version: 1.5.19.0 - Sony)
Media Go Video Playback Engine 2.4.132.12090 (HKLM-x32\...\{7C5AEEE1-6D7C-8922-4548-7BF9096077EC}) (Version: 2.4.132.12090 - Sony)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0 - Microsoft Corporation) Hidden
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
MyWinLocker (Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.24 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.) Hidden
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.9013 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9013 - NTI Corporation) Hidden
NVIDIA Grafiktreiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.02 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.133.889 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.14.17 (Version: 1.14.17 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.12.0613 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.12.0613 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0613 - NVIDIA Corporation)
NVIDIA Systemsteuerung 327.02 (Version: 327.02 - NVIDIA Corporation) Hidden
NVIDIA Update 1.14.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.14.17 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.14.17 - NVIDIA Corporation) Hidden
Office Addin (HKLM-x32\...\{6D2BBE1D-E600-4695-BA37-0B0E605542CC}) (Version: 2.01.3202 - Acer)
Office Addin 2003 (HKLM-x32\...\{1FCC073B-CC01-4443-AD20-E559F66E6E83}) (Version: 2.01.3202 - Acer)
Origin (HKLM-x32\...\Origin) (Version: 9.2.1.4399 - Electronic Arts, Inc.)
PDF24 Creator 6.4.1 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.214 - Qualcomm Atheros Communications)
Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 11.21 - Qualcomm Atheros)
R for Windows 3.0.2 (HKLM\...\R for Windows 3.0.2_is1) (Version: 3.0.2 - R Core Team)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Shopping Blocks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Sony Mobile Update Engine (HKLM-x32\...\Update Engine) (Version: 2.14.8.201405281228 - Sony Mobile Communications AB)
Sony PC Companion 2.10.221 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.221 - Sony)
Spotify (HKLM-x32\...\Spotify) (Version: 0.8.4.99.ga249b5f1 - Spotify AB)
System Requirements Lab CYRI (HKLM-x32\...\{19B0831B-0C18-4103-86E4-90FCD04CD3B9}) (Version: 6.0.12.5 - Husdawg, LLC)
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VoiceOver Kit (HKLM-x32\...\{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}) (Version: 1.42.128.0 - Apple Inc.)
Vokabel Trainer 5 (HKLM-x32\...\{5E0D2061-86AB-4B83-A671-A0BF3FF1537B}_is1) (Version:  - Manuel Wäschle)
WildTangent-Spiele (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

31-07-2014 11:29:35 Geplanter Prüfpunkt
06-08-2014 20:33:55 Installed Java 7 Update 67
08-08-2014 14:27:34 Avira Free Antivirus - 08.08.2014 16:27
12-08-2014 06:28:47 eBay Worldwide wird entfernt
15-08-2014 11:46:13 Windows Modules Installer
22-08-2014 16:27:14 Sony PC Companion

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B350D20-A675-41C5-85A9-D27862EBA789} - System32\Tasks\iuEmailOutlookAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe [2012-08-23] ()
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {31C54016-63C9-4A1E-98E5-886EBC7BB47D} - \a2zLyrics-16-updater No Task File <==== ATTENTION
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3558E594-835D-440C-BE23-F971D0D70EF1} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {374C3719-F7B0-4CA0-AC86-A417AF209DD0} - System32\Tasks\avgntfltavipbbavkmgr => C:\WINDOWS\UOINSTLMv7.EXE
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {3DA36C08-668B-4003-8655-9BA5D1ED0E1F} - \a2zLyrics-16-chromeinstaller No Task File <==== ATTENTION
Task: {464BB915-D7B3-4E38-B71E-60C070AA05F2} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {4AC8B08D-B527-49D5-9DFF-AD3169366ABD} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2012-09-20] (CyberLink)
Task: {521FF5A1-FA4F-4838-AA7C-D083919EFFFE} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-11-06] ()
Task: {580813B3-FEB5-4195-9E1E-10F701DB7A85} - \a2zLyrics-16-enabler No Task File <==== ATTENTION
Task: {5C8DC5F6-6784-4CAC-9EAA-C6C6C260F360} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-10-23] (Acer Incorporated)
Task: {5E2FC257-2E29-478E-9D8B-E2551FF818D8} - \a2zLyrics-16-codedownloader No Task File <==== ATTENTION
Task: {66257F65-FAE3-4EF3-8B01-4D5788D32CC1} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-08-15] (Microsoft Corporation)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6AF73DBF-0F28-4D8E-9913-162B9AC79410} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-23] (Google Inc.)
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {78855C47-6D41-4433-BD1D-889F461BC546} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {827B111E-DD01-4665-8852-D8707D9FD166} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-23] (Google Inc.)
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {8D8D8DC8-12B5-42A1-9978-70747734D13A} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-21] ()
Task: {99857588-E187-42E7-9792-131E61AB5EFD} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A7220801-FF0B-4DB1-B491-6A2D4D2899DF} - System32\Tasks\FileAssociationManagerUpdater => C:\Program Files (x86)\FileAssociationManager\Updater.exe
Task: {AB407D31-3406-4419-B424-703A519A04E0} - System32\Tasks\iuBrowserIEAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe [2012-08-23] ()
Task: {BDB0AD9D-F6C4-496A-9704-F7FA985D8E50} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {C775C7F8-3892-45DE-B221-67E250ED6930} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA057EB1-382E-4978-B34E-DA9C61E16888} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E15B4CD7-0F0A-432E-8F78-96244B972DA1} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {E16462A9-833E-4FEC-AF67-A21760B293F6} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {EF99D8E2-00EB-4096-84E1-C639C645BBF0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {F19DE44C-1993-4C51-8962-BAFA6946A7E8} - \CreateChoiceProcessTask No Task File <==== ATTENTION
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 02:36 - 2013-09-05 02:36 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2013-10-03 23:42 - 2013-10-03 23:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-11-16 11:56 - 2014-06-23 09:07 - 00113376 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
2012-11-05 20:28 - 2012-11-05 20:28 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll
2012-11-05 20:23 - 2012-11-05 20:23 - 00020992 _____ () C:\Program Files (x86)\Bluetooth Suite\L10n\de-DE\BtTray.de-DE.dll
2012-11-05 20:26 - 2012-11-05 20:26 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2012-11-05 20:28 - 2012-11-05 20:28 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
2012-08-23 01:04 - 2012-08-23 01:04 - 00044176 _____ () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
2012-08-23 01:04 - 2012-08-23 01:04 - 00025232 _____ () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-03-04 12:49 - 2011-03-04 12:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2012-11-03 02:38 - 2012-11-03 02:38 - 00465384 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-11-03 02:37 - 2012-11-03 02:37 - 00125504 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2012-11-03 02:38 - 2012-11-03 02:38 - 00155712 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\VolumeSnapshot.dll
2012-11-03 02:37 - 2012-11-03 02:37 - 00118336 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\Online.dll
2012-11-03 02:37 - 2012-11-03 02:37 - 01081408 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-11-03 02:37 - 2012-11-03 02:37 - 00052288 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OsSettingPort.dll
2012-11-03 02:37 - 2012-11-03 02:37 - 00727616 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OutlookShadow.dll
2014-07-24 11:50 - 2014-07-24 11:50 - 00137296 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-07-24 11:49 - 2014-07-24 11:49 - 00065104 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2013-03-12 07:17 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2013-11-16 11:56 - 2012-04-30 11:57 - 00039936 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\TMonitorAPI.dll
2013-11-16 11:56 - 2013-09-13 11:02 - 00208896 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\MExplorer.dll
2011-07-07 14:54 - 2011-07-07 14:54 - 00233984 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\Report.dll
2013-11-16 11:56 - 2013-05-20 12:58 - 00620718 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\sqlite3.dll
2014-05-26 16:19 - 2014-05-26 16:19 - 00590848 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PhoneUpdate.dll
2014-08-07 08:49 - 2014-07-24 11:50 - 00049744 _____ () C:\Users\Jutta\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-08-08 18:07 - 2014-08-22 10:52 - 00012288 _____ () C:\Program Files (x86)\Google\Chrome\Application\WTSAPI32.dll
2014-08-15 18:54 - 2014-08-07 05:20 - 00718152 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\libglesv2.dll
2014-08-15 18:54 - 2014-08-07 05:20 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\libegl.dll
2014-08-15 18:54 - 2014-08-07 05:20 - 08537928 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\pdf.dll
2014-08-15 18:54 - 2014-08-07 05:20 - 00353096 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ppGoogleNaClPluginChrome.dll
2014-08-15 18:54 - 2014-08-07 05:20 - 01732936 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Jutta\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "CanonQuickMenu"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "Download Protect"
HKLM\...\StartupApproved\Run32: => "PDFPrint"

==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/23/2014 11:54:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: adwcleaner_3.308.exe, Version: 3.3.0.8, Zeitstempel: 0x4f25baec
Name des fehlerhaften Moduls: adwcleaner_3.308.exe, Version: 3.3.0.8, Zeitstempel: 0x4f25baec
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000111c9
ID des fehlerhaften Prozesses: 0xf4c
Startzeit der fehlerhaften Anwendung: 0xadwcleaner_3.308.exe0
Pfad der fehlerhaften Anwendung: adwcleaner_3.308.exe1
Pfad des fehlerhaften Moduls: adwcleaner_3.308.exe2
Berichtskennung: adwcleaner_3.308.exe3
Vollständiger Name des fehlerhaften Pakets: adwcleaner_3.308.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: adwcleaner_3.308.exe5

Error: (08/23/2014 02:15:07 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7563

Error: (08/23/2014 02:15:07 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7563

Error: (08/23/2014 02:15:07 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/23/2014 02:15:06 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6438

Error: (08/23/2014 02:15:06 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6438

Error: (08/23/2014 02:15:06 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/23/2014 02:15:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5297

Error: (08/23/2014 02:15:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5297

Error: (08/23/2014 02:15:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (08/16/2014 00:37:10 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (08/15/2014 10:17:39 PM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (08/12/2014 03:33:30 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "DANIEL-PC",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{6A596D42-49BA-4B9C-8AE9-8F5241ED4BE8}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (08/11/2014 08:44:49 AM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (08/09/2014 11:04:14 AM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (08/06/2014 08:31:14 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.0.105
registriert werden. Der Computer mit IP-Adresse 192.168.0.103 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (08/06/2014 08:49:21 AM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (08/02/2014 00:30:20 PM) (Source: DCOM) (EventID: 10016) (User: JUTTAPC)
Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}JuttaPCJuttaS-1-5-21-1768041208-787304100-1710538151-1002LocalHost (unter Verwendung von LRPC)Microsoft.BingNews_3.0.2.309_x64__8wekyb3d8bbweS-1-15-2-508114518-3340871649-811464485-526616082-4258465299-1774086546-1865468257

Error: (07/22/2014 08:07:15 PM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (07/21/2014 07:44:35 PM) (Source: DCOM) (EventID: 10010) (User: JUTTAPC)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca


Microsoft Office Sessions:
=========================
Error: (02/08/2014 11:26:38 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6690.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 12 seconds with 0 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2014-08-21 22:38:35.138
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-3630QM CPU @ 2.40GHz
Percentage of memory in use: 27%
Total physical RAM: 8007.27 MB
Available physical RAM: 5831.39 MB
Total Pagefile: 9287.27 MB
Available Pagefile: 6979.56 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:911.85 GB) (Free:787.19 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 34952447)

Partition: GPT Partition Type.

==================== End Of Log ============================

Bootsektor · 23.08.2014, 11:51

Hallo,

wiederhole bitte den FRST-Scan, diesmal ohne addition anzuhaken, soltle das Log wieder nur so kurz sein, lösche die FRST64.exe und lade sie dir erneut herunter.

JuttaS. · 23.08.2014, 14:03

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-08-2014
Ran by Jutta (administrator) on JUTTAPC on 23-08-2014 15:01:56
Running from C:\Users\Jutta\Downloads
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20573_x64__8wekyb3d8bbwe\livecomm.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
(Spotify Ltd) C:\Users\Jutta\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(Dritek System Inc.) C:\Program Files (x86)\RadioController\RfBtnHelper.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2873744 2012-11-20] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BtPreLoad] => C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-11-05] ()
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [LManager] => [X]
HKLM-x32\...\Run: [RadioController] => C:\Program Files (x86)\RadioController\RfBtnHelper.exe [111216 2013-03-12] (Dritek System Inc.)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-06] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1273448 2012-04-03] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191016 2014-05-14] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [190032 2014-07-24] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1768041208-787304100-1710538151-1001\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2013-08-22] (Microsoft Corporation)
HKU\S-1-5-21-1768041208-787304100-1710538151-1002\...\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-1768041208-787304100-1710538151-1002\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [467680 2014-07-30] (Sony)
HKU\S-1-5-21-1768041208-787304100-1710538151-1002\...\Run: [Spotify Web Helper] => C:\Users\Jutta\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1178168 2014-07-17] (Spotify Ltd)
HKU\S-1-5-21-1768041208-787304100-1710538151-1002\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [457728 2013-09-30] (Microsoft Corporation)
HKU\S-1-5-21-1768041208-787304100-1710538151-1002\...\MountPoints2: {e7e8478f-4e22-11e3-be7c-208984642363} - "E:\Startme.exe" 
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
AppInit_DLLs: ,C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [141336 2013-09-05] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer Backup Manager Tray.lnk
ShortcutTarget: Acer Backup Manager Tray.lnk -> C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {00C1F671-9C43-498A-B47C-EB1909040B49} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - {00C1F671-9C43-498A-B47C-EB1909040B49} URL = 
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\zsdyt9r2.default
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-06-07]
FF Extension: No Name - C:\WINDOWS\Installer\{2BBB60CE-AE68-4CEB-BAE3-3A139930D9D5}\{C17606FE-6872-4033-B125-AEDC5E3F233A}.xpi []

Chrome: 
=======
CHR HomePage: hxxp://www.google.de?hl=de&gl=de
CHR StartupUrls: "hxxp://www.google.de?hl=de&gl=de"
CHR Extension: (Google Docs) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-10-23]
CHR Extension: (Google Drive) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-10-23]
CHR Extension: (YouTube) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-10-23]
CHR Extension: (Google-Suche) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-10-23]
CHR Extension: (AdBlock) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-10-25]
CHR Extension: (Download Protect) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\hialmlehfaanlffiliclpacmihbfdkpl [2014-08-22]
CHR Extension: (Google Wallet) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-23]
CHR Extension: (Citavi Picker) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-06-08]
CHR Extension: (Google Mail) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-10-23]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - C:\Program Files (x86)\Citavi 4\Pickers\Chrome\ChromePicker.crx [2014-02-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-06] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-06] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1021520 2014-08-06] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [231040 2012-11-05] (Qualcomm Atheros Commnucations)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-24] (Avira Operations GmbH & Co. KG)
R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.) [File not signed]
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2449552 2012-10-25] (Acer Incorporated)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-17] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658064 2012-10-23] (Acer Incorporated)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-11-03] (NTI Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [96880 2013-03-12] (Dritek System INC.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-11-09] (Atheros)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [42040 2014-07-10] (Avira Operations GmbH & Co. KG)
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 CVPNDRVA; C:\WINDOWS\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-21] (Malwarebytes Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2013-03-12] (Dritek System Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
S3 BTATH_LWFLT; \SystemRoot\system32\DRIVERS\btath_lwflt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-23 12:08 - 2014-08-23 15:01 - 00019686 _____ () C:\Users\Jutta\Downloads\FRST.txt
2014-08-23 12:07 - 2014-08-23 12:08 - 00038464 _____ () C:\Users\Jutta\Downloads\Addition.txt
2014-08-23 12:05 - 2014-08-23 12:05 - 00000000 ____D () C:\Users\Jutta\Downloads\FRST-OlderVersion
2014-08-22 10:52 - 2014-08-22 10:49 - 01364531 _____ () C:\Users\Jutta\Desktop\adwcleaner_3.308.exe
2014-08-22 10:49 - 2014-08-22 10:49 - 01364531 _____ () C:\Users\Jutta\Downloads\adwcleaner_3.308.exe
2014-08-21 22:14 - 2014-01-19 09:38 - 00270496 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-08-21 11:29 - 2014-08-21 11:29 - 00018686 _____ () C:\Users\Jutta\Desktop\malwarebytes.txt
2014-08-20 18:04 - 2014-08-20 18:04 - 00003997 _____ () C:\Users\Jutta\Desktop\Gmer.txt
2014-08-20 18:00 - 2014-08-20 18:00 - 00380416 _____ () C:\Users\Jutta\Downloads\wq91hk15.exe
2014-08-20 17:53 - 2014-08-23 12:05 - 02102784 _____ (Farbar) C:\Users\Jutta\Downloads\FRST64.exe
2014-08-20 17:53 - 2014-08-20 17:58 - 00059929 _____ () C:\Users\Jutta\Desktop\FRST.txt
2014-08-20 17:50 - 2014-08-20 17:52 - 00000472 _____ () C:\Users\Jutta\Desktop\defogger_disable.log
2014-08-20 17:50 - 2014-08-20 17:50 - 00000000 _____ () C:\Users\Jutta\defogger_reenable
2014-08-20 17:48 - 2014-08-20 17:48 - 00050477 _____ () C:\Users\Jutta\Downloads\Defogger.exe
2014-08-14 12:52 - 2014-08-14 12:52 - 00001511 _____ () C:\Users\Public\Desktop\Die Sims 4 Erstelle einen Sim-Demo.lnk
2014-08-14 12:52 - 2014-08-14 12:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4 Erstelle einen Sim-Demo
2014-08-14 12:40 - 2014-08-14 12:43 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-08-14 12:40 - 2014-08-14 12:42 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Origin
2014-08-14 09:57 - 2014-08-14 09:57 - 00000000 ____D () C:\ProgramData\SystemRequirementsLab
2014-08-14 09:57 - 2014-08-14 09:57 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-08-13 21:06 - 2014-08-02 05:11 - 00918528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-08-13 07:29 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-08-13 07:29 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-08-13 07:29 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-08-13 07:29 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-08-13 07:29 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-08-13 07:29 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-08-13 07:29 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2014-08-13 07:29 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-08-13 07:29 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-08-13 07:29 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-08-13 07:29 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\JavaScriptCollectionAgent.dll
2014-08-13 07:29 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-08-13 07:29 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-08-13 07:29 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-08-13 07:29 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2014-08-13 07:29 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-08-13 07:29 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2014-08-13 07:29 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-08-13 07:29 - 2014-07-25 13:43 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-08-13 07:29 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 07:29 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-08-13 07:29 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-08-13 07:29 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-08-13 07:29 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-08-13 07:29 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-08-13 07:29 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-08-13 07:29 - 2014-07-25 13:09 - 00291840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-08-13 07:29 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-08-13 07:29 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-08-13 07:29 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-08-13 07:29 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-08-13 07:29 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-08-13 07:29 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-08-13 07:29 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-08-13 07:29 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-08-13 07:28 - 2014-06-20 03:48 - 01273184 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2014-08-13 07:28 - 2014-06-20 01:52 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2014-08-13 07:28 - 2014-06-13 03:15 - 00517528 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2014-08-13 07:28 - 2014-06-13 03:14 - 01557848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2014-08-13 07:28 - 2014-06-13 02:10 - 00406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2014-08-13 07:28 - 2014-06-06 13:34 - 02133504 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2014-08-13 07:27 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2014-08-13 07:27 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2014-08-13 07:27 - 2014-05-31 08:27 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2014-08-13 07:26 - 2014-08-07 04:12 - 01336624 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2014-08-13 07:26 - 2014-08-07 00:39 - 04148224 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-08-13 07:26 - 2014-08-02 05:56 - 01064448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2014-08-13 07:26 - 2014-07-15 20:16 - 03048880 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcMon.exe
2014-08-13 07:26 - 2014-07-15 10:29 - 03118080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wpc.dll
2014-08-13 07:26 - 2014-07-15 10:22 - 02861056 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebSync.dll
2014-08-13 07:26 - 2014-07-15 10:03 - 02344448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wpc.dll
2014-08-13 07:26 - 2014-07-12 06:17 - 00623616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2014-08-13 07:26 - 2014-07-10 06:16 - 00716800 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2014-08-13 07:26 - 2014-07-10 06:03 - 04756992 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-08-13 07:26 - 2014-07-10 05:33 - 01120256 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-08-13 07:26 - 2014-06-05 16:13 - 00216368 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
2014-08-13 07:26 - 2014-06-05 15:14 - 00189016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll
2014-08-13 07:26 - 2014-06-04 11:27 - 00114520 _____ (Microsoft Corporation) C:\WINDOWS\system32\consent.exe
2014-08-13 07:26 - 2014-06-04 07:31 - 00356352 _____ (Microsoft Corporation) C:\WINDOWS\system32\msihnd.dll
2014-08-13 07:26 - 2014-06-04 07:22 - 02790912 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2014-08-13 07:26 - 2014-06-04 06:43 - 00281088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msihnd.dll
2014-08-13 07:26 - 2014-06-04 06:38 - 03304448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2014-08-13 07:26 - 2014-06-04 04:15 - 02642944 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-08-13 07:26 - 2014-06-04 04:14 - 02318336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-08-13 07:26 - 2014-06-02 04:10 - 00423768 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2014-08-13 07:26 - 2014-05-31 12:07 - 00467800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2014-08-13 07:26 - 2014-05-31 12:07 - 00440664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbport.sys
2014-08-13 07:26 - 2014-05-31 12:07 - 00419672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2014-08-13 07:26 - 2014-05-31 12:07 - 00089944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbehci.sys
2014-08-13 07:26 - 2014-05-31 12:07 - 00027480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbd.sys
2014-08-13 07:26 - 2014-05-31 08:30 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbuhci.sys
2014-08-13 07:26 - 2014-05-31 08:27 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WUDFPf.sys
2014-08-13 07:26 - 2014-05-31 08:26 - 00227840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WUDFRd.sys
2014-08-13 07:26 - 2014-05-31 06:01 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFHost.exe
2014-08-13 07:26 - 2014-05-31 06:01 - 00209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFPlatform.dll
2014-08-13 07:26 - 2014-05-31 06:01 - 00099840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFSvc.dll
2014-08-13 07:26 - 2014-05-27 17:53 - 02518360 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-08-13 07:26 - 2014-05-27 11:56 - 00323584 _____ (Microsoft Corporation) C:\WINDOWS\system32\DaOtpCredentialProvider.dll
2014-08-13 07:26 - 2014-05-27 11:53 - 00270848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DaOtpCredentialProvider.dll
2014-08-13 07:26 - 2014-05-17 06:59 - 16871936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2014-08-13 07:26 - 2014-05-17 06:13 - 12711424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2014-08-13 07:26 - 2014-05-13 09:01 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\BulkOperationHost.exe
2014-08-13 07:26 - 2014-05-13 07:07 - 02844160 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2014-08-13 07:26 - 2014-05-13 06:41 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2014-08-13 07:26 - 2014-05-13 06:26 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveShell.dll
2014-08-13 07:26 - 2014-05-13 05:59 - 01035264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2014-08-13 07:26 - 2014-05-13 05:31 - 00265216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SkyDriveShell.dll
2014-08-13 07:26 - 2014-05-03 13:29 - 01726224 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-08-13 07:26 - 2014-05-03 11:20 - 01473080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-08-13 07:26 - 2014-05-03 07:36 - 00997888 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2014-08-13 07:26 - 2014-05-03 07:19 - 00071168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncobjapi.dll
2014-08-13 07:26 - 2014-05-03 07:08 - 00301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\framedynos.dll
2014-08-13 07:26 - 2014-05-03 07:07 - 00262656 _____ (Microsoft Corporation) C:\WINDOWS\system32\framedyn.dll
2014-08-13 07:26 - 2014-05-03 06:46 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncobjapi.dll
2014-08-13 07:26 - 2014-05-03 06:37 - 00235008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\framedynos.dll
2014-08-13 07:26 - 2014-05-03 06:37 - 00207360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\framedyn.dll
2014-08-13 07:26 - 2014-05-03 01:26 - 00050745 _____ () C:\WINDOWS\system32\srms.dat
2014-08-13 07:26 - 2014-05-01 07:44 - 01025536 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2014-08-13 07:26 - 2014-04-30 08:43 - 00071680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vwififlt.sys
2014-08-13 07:26 - 2014-04-30 08:41 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2014-08-13 07:26 - 2014-04-30 08:41 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\agilevpn.sys
2014-08-13 07:26 - 2014-04-30 08:41 - 00038912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vwifimp.sys
2014-08-13 07:26 - 2014-04-30 07:45 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Robocopy.exe
2014-08-13 07:26 - 2014-04-30 06:48 - 00106496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Robocopy.exe
2014-08-13 07:26 - 2014-04-30 06:24 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcsvc6.dll
2014-08-13 07:26 - 2014-04-30 06:23 - 00353280 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore.dll
2014-08-13 07:26 - 2014-04-30 06:23 - 00271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore6.dll
2014-08-13 07:26 - 2014-04-30 06:23 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcsvc.dll
2014-08-13 07:26 - 2014-04-30 06:14 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2014-08-13 07:26 - 2014-04-30 05:59 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2014-08-13 07:26 - 2014-04-30 05:46 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore.dll
2014-08-13 07:26 - 2014-04-30 05:46 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore6.dll
2014-08-13 07:26 - 2014-04-30 05:46 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcsvc6.dll
2014-08-13 07:26 - 2014-04-30 05:45 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcsvc.dll
2014-08-13 07:26 - 2014-04-30 05:42 - 00403968 _____ (Microsoft Corporation) C:\WINDOWS\system32\vpnike.dll
2014-08-13 07:26 - 2014-04-29 00:40 - 00721408 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2014-08-13 07:26 - 2014-04-27 00:03 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2014-08-13 07:26 - 2014-04-26 22:14 - 02144984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2014-08-13 07:26 - 2014-04-26 18:39 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2014-08-13 07:26 - 2014-04-14 11:37 - 02125344 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2014-08-13 07:26 - 2014-04-14 10:08 - 01797896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2014-08-13 07:26 - 2014-04-14 07:18 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8thk.dll
2014-08-13 07:26 - 2014-04-09 08:11 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2014-08-13 07:26 - 2014-04-09 07:20 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2014-08-12 09:33 - 2014-08-12 09:37 - 00038948 _____ () C:\Users\Jutta\Desktop\Addition.txt
2014-08-12 09:32 - 2014-08-23 15:01 - 00000000 ____D () C:\FRST
2014-08-12 09:11 - 2014-08-12 09:11 - 00013824 ___SH () C:\Users\Jutta\AppData\Local\Thumbs.db
2014-08-12 09:09 - 2014-08-12 09:09 - 00002772 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2014-08-12 09:09 - 2014-08-12 09:09 - 00000838 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-12 09:09 - 2014-08-12 09:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-12 09:08 - 2014-08-12 09:08 - 03738080 _____ (Piriform Ltd) C:\Users\Jutta\Downloads\ccsetup416_slim.exe
2014-08-12 08:40 - 2014-08-21 11:08 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-12 08:40 - 2014-08-12 08:40 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-12 08:40 - 2014-08-12 08:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-12 08:40 - 2014-08-12 08:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-12 08:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-08-12 08:40 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-08-12 08:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-08-12 08:31 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\SysWOW64\sqlite3.dll
2014-08-12 08:30 - 2014-08-12 08:30 - 01366203 _____ () C:\Users\Jutta\Downloads\adwcleaner_3.304.exe
2014-08-08 18:07 - 2014-08-22 10:52 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-08-07 08:49 - 2014-08-07 08:55 - 00001157 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-06 22:35 - 2014-08-06 22:35 - 00000000 ____D () C:\ProgramData\Sun
2014-08-06 22:35 - 2014-08-06 22:35 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-06 22:35 - 2014-08-06 22:34 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-08-06 22:34 - 2014-08-06 22:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-06 22:34 - 2014-08-06 22:34 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-08-06 22:34 - 2014-08-06 22:34 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-08-06 22:34 - 2014-08-06 22:34 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-08-06 22:34 - 2014-08-06 22:34 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-06 22:31 - 2014-08-06 22:31 - 00918440 _____ (Oracle Corporation) C:\Users\Jutta\Downloads\chromeinstall-7u67.exe
2014-07-30 23:42 - 2014-07-30 23:43 - 16806776 _____ (DsNET Corp ) C:\Users\Jutta\Downloads\aTubeCatcher.exe
2014-07-27 12:16 - 2014-07-27 12:16 - 00001480 _____ () C:\Users\Jutta\AppData\Local\recently-used.xbel
2014-07-27 12:11 - 2014-07-27 12:16 - 00000000 ____D () C:\Users\Jutta\AppData\Local\gtk-2.0
2014-07-27 12:11 - 2014-07-27 12:11 - 00000000 ____D () C:\Users\Jutta\.thumbnails
2014-07-27 11:21 - 2014-07-27 12:18 - 00000000 ____D () C:\Users\Jutta\.gimp-2.8
2014-07-27 11:21 - 2014-07-27 11:21 - 00000000 ____D () C:\Users\Jutta\AppData\Local\gegl-0.2
2014-07-27 11:14 - 2014-08-12 08:28 - 00000000 ____D () C:\Program Files\GIMP 2
2014-07-27 11:11 - 2014-07-27 11:11 - 00003612 _____ () C:\WINDOWS\System32\Tasks\avgntfltavipbbavkmgr
2014-07-27 11:05 - 2014-07-27 11:06 - 13483938 _____ () C:\Users\Jutta\Downloads\JPG-Illuminator_v459.zip
2014-07-27 11:04 - 2014-07-27 11:04 - 00826192 _____ (Chip Digital GmbH) C:\Users\Jutta\Downloads\JPG Illuminator - CHIP-Installer.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-23 15:02 - 2014-08-23 12:08 - 00019686 _____ () C:\Users\Jutta\Downloads\FRST.txt
2014-08-23 15:01 - 2014-08-12 09:32 - 00000000 ____D () C:\FRST
2014-08-23 15:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-08-23 13:31 - 2013-10-18 10:38 - 00003926 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{969F4F97-82F5-40F1-80F1-9910D56C3A15}
2014-08-23 13:23 - 2013-10-18 08:44 - 01174569 _____ () C:\WINDOWS\WindowsUpdate.log
2014-08-23 12:16 - 2013-10-15 05:29 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1768041208-787304100-1710538151-1002
2014-08-23 12:08 - 2014-08-23 12:07 - 00038464 _____ () C:\Users\Jutta\Downloads\Addition.txt
2014-08-23 12:05 - 2014-08-23 12:05 - 00000000 ____D () C:\Users\Jutta\Downloads\FRST-OlderVersion
2014-08-23 12:05 - 2014-08-20 17:53 - 02102784 _____ (Farbar) C:\Users\Jutta\Downloads\FRST64.exe
2014-08-23 12:05 - 2013-09-30 06:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-08-23 12:05 - 2013-09-30 05:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-08-23 12:05 - 2013-09-30 05:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-08-23 12:02 - 2013-10-18 09:39 - 00000000 ___DO () C:\Users\Jutta\SkyDrive
2014-08-23 12:01 - 2013-10-23 10:15 - 00002199 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-23 12:01 - 2013-10-23 10:15 - 00001120 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-23 11:58 - 2013-09-29 21:04 - 00170634 _____ () C:\WINDOWS\PFRO.log
2014-08-23 11:58 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-08-23 11:57 - 2013-10-26 18:36 - 00000000 ____D () C:\AdwCleaner
2014-08-23 11:57 - 2013-08-22 15:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2014-08-23 11:53 - 2013-10-23 10:15 - 00001124 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-23 11:46 - 2014-02-14 09:35 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\Spotify
2014-08-22 18:27 - 2013-03-12 07:23 - 00270124 _____ () C:\WINDOWS\DPINST.LOG
2014-08-22 18:26 - 2014-01-27 11:22 - 00002046 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2014-08-22 18:26 - 2013-11-16 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2014-08-22 18:26 - 2012-12-14 04:06 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-08-22 16:33 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-08-22 10:52 - 2014-08-08 18:07 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-08-22 10:49 - 2014-08-22 10:52 - 01364531 _____ () C:\Users\Jutta\Desktop\adwcleaner_3.308.exe
2014-08-22 10:49 - 2014-08-22 10:49 - 01364531 _____ () C:\Users\Jutta\Downloads\adwcleaner_3.308.exe
2014-08-21 22:15 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-08-21 22:06 - 2013-10-18 08:45 - 00000000 ____D () C:\Users\Jutta
2014-08-21 11:29 - 2014-08-21 11:29 - 00018686 _____ () C:\Users\Jutta\Desktop\malwarebytes.txt
2014-08-21 11:08 - 2014-08-12 08:40 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-20 18:09 - 2013-08-22 16:44 - 00374984 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-08-20 18:04 - 2014-08-20 18:04 - 00003997 _____ () C:\Users\Jutta\Desktop\Gmer.txt
2014-08-20 18:00 - 2014-08-20 18:00 - 00380416 _____ () C:\Users\Jutta\Downloads\wq91hk15.exe
2014-08-20 17:58 - 2014-08-20 17:53 - 00059929 _____ () C:\Users\Jutta\Desktop\FRST.txt
2014-08-20 17:52 - 2014-08-20 17:50 - 00000472 _____ () C:\Users\Jutta\Desktop\defogger_disable.log
2014-08-20 17:50 - 2014-08-20 17:50 - 00000000 _____ () C:\Users\Jutta\defogger_reenable
2014-08-20 17:48 - 2014-08-20 17:48 - 00050477 _____ () C:\Users\Jutta\Downloads\Defogger.exe
2014-08-20 17:13 - 2013-08-22 16:46 - 00339261 _____ () C:\WINDOWS\setupact.log
2014-08-20 17:12 - 2014-02-14 09:35 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Spotify
2014-08-20 14:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-08-16 08:56 - 2014-02-26 15:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-16 08:53 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-08-16 08:53 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-08-16 08:53 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\MediaViewer
2014-08-16 08:53 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\FileManager
2014-08-16 08:53 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Camera
2014-08-15 13:54 - 2013-10-17 06:35 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-08-15 13:54 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-08-15 13:49 - 2013-10-17 06:35 - 99218768 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-08-14 12:59 - 2013-10-24 12:03 - 00000000 ____D () C:\ProgramData\Origin
2014-08-14 12:59 - 2013-10-23 10:24 - 00000000 ____D () C:\Users\Jutta\Documents\Electronic Arts
2014-08-14 12:59 - 2013-10-22 13:17 - 00000000 ____D () C:\ProgramData\Electronic Arts
2014-08-14 12:52 - 2014-08-14 12:52 - 00001511 _____ () C:\Users\Public\Desktop\Die Sims 4 Erstelle einen Sim-Demo.lnk
2014-08-14 12:52 - 2014-08-14 12:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4 Erstelle einen Sim-Demo
2014-08-14 12:43 - 2014-08-14 12:40 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-08-14 12:42 - 2014-08-14 12:40 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Origin
2014-08-14 12:42 - 2013-10-24 12:04 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\Origin
2014-08-14 12:41 - 2013-10-24 12:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2014-08-14 12:41 - 2013-10-24 12:03 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-08-14 09:57 - 2014-08-14 09:57 - 00000000 ____D () C:\ProgramData\SystemRequirementsLab
2014-08-14 09:57 - 2014-08-14 09:57 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-08-13 14:01 - 2013-10-18 09:59 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-13 07:19 - 2014-04-10 12:11 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-08-13 07:19 - 2014-04-10 12:11 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-08-12 09:37 - 2014-08-12 09:33 - 00038948 _____ () C:\Users\Jutta\Desktop\Addition.txt
2014-08-12 09:11 - 2014-08-12 09:11 - 00013824 ___SH () C:\Users\Jutta\AppData\Local\Thumbs.db
2014-08-12 09:09 - 2014-08-12 09:09 - 00002772 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2014-08-12 09:09 - 2014-08-12 09:09 - 00000838 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-12 09:09 - 2014-08-12 09:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-12 09:08 - 2014-08-12 09:08 - 03738080 _____ (Piriform Ltd) C:\Users\Jutta\Downloads\ccsetup416_slim.exe
2014-08-12 08:40 - 2014-08-12 08:40 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-12 08:40 - 2014-08-12 08:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-12 08:40 - 2014-08-12 08:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-12 08:40 - 2013-10-29 21:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-12 08:30 - 2014-08-12 08:30 - 01366203 _____ () C:\Users\Jutta\Downloads\adwcleaner_3.304.exe
2014-08-12 08:28 - 2014-07-27 11:14 - 00000000 ____D () C:\Program Files\GIMP 2
2014-08-09 09:08 - 2013-11-25 21:50 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-08-09 09:02 - 2014-05-18 19:39 - 00201216 ___SH () C:\Users\Jutta\Desktop\Thumbs.db
2014-08-09 09:02 - 2013-10-27 16:04 - 00000000 ____D () C:\Users\Jutta\Documents\UNI
2014-08-08 20:25 - 2013-10-18 10:45 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Deployment
2014-08-08 18:07 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-08-07 08:55 - 2014-08-07 08:49 - 00001157 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-07 08:55 - 2014-05-31 21:20 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-07 08:55 - 2013-10-23 10:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-07 08:55 - 2013-10-23 10:25 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-07 08:49 - 2013-10-23 10:25 - 00000000 ____D () C:\ProgramData\Avira
2014-08-07 04:12 - 2014-08-13 07:26 - 01336624 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2014-08-07 00:39 - 2014-08-13 07:26 - 04148224 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-08-06 22:35 - 2014-08-06 22:35 - 00000000 ____D () C:\ProgramData\Sun
2014-08-06 22:35 - 2014-08-06 22:35 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-06 22:35 - 2014-08-06 22:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-06 22:34 - 2014-08-06 22:35 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-08-06 22:34 - 2014-08-06 22:34 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-08-06 22:34 - 2014-08-06 22:34 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-08-06 22:34 - 2014-08-06 22:34 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-08-06 22:34 - 2014-08-06 22:34 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-06 22:31 - 2014-08-06 22:31 - 00918440 _____ (Oracle Corporation) C:\Users\Jutta\Downloads\chromeinstall-7u67.exe
2014-08-02 05:56 - 2014-08-13 07:26 - 01064448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2014-08-02 05:11 - 2014-08-13 21:06 - 00918528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-08-02 02:17 - 2013-08-22 17:38 - 00704480 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-08-02 02:17 - 2013-08-22 17:38 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-01 07:42 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-07-30 23:43 - 2014-07-30 23:42 - 16806776 _____ (DsNET Corp ) C:\Users\Jutta\Downloads\aTubeCatcher.exe
2014-07-27 12:18 - 2014-07-27 11:21 - 00000000 ____D () C:\Users\Jutta\.gimp-2.8
2014-07-27 12:16 - 2014-07-27 12:16 - 00001480 _____ () C:\Users\Jutta\AppData\Local\recently-used.xbel
2014-07-27 12:16 - 2014-07-27 12:11 - 00000000 ____D () C:\Users\Jutta\AppData\Local\gtk-2.0
2014-07-27 12:11 - 2014-07-27 12:11 - 00000000 ____D () C:\Users\Jutta\.thumbnails
2014-07-27 11:21 - 2014-07-27 11:21 - 00000000 ____D () C:\Users\Jutta\AppData\Local\gegl-0.2
2014-07-27 11:11 - 2014-07-27 11:11 - 00003612 _____ () C:\WINDOWS\System32\Tasks\avgntfltavipbbavkmgr
2014-07-27 11:06 - 2014-07-27 11:05 - 13483938 _____ () C:\Users\Jutta\Downloads\JPG-Illuminator_v459.zip
2014-07-27 11:04 - 2014-07-27 11:04 - 00826192 _____ (Chip Digital GmbH) C:\Users\Jutta\Downloads\JPG Illuminator - CHIP-Installer.exe
2014-07-27 10:53 - 2013-03-12 07:49 - 00000000 ____D () C:\ProgramData\CyberLink
2014-07-27 10:52 - 2014-06-01 00:13 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Cyberlink
2014-07-25 18:12 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-07-25 16:52 - 2014-08-13 07:29 - 23645696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-07-25 15:51 - 2014-08-13 07:29 - 17524224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-07-25 15:28 - 2014-08-13 07:29 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-07-25 15:25 - 2014-08-13 07:29 - 02774528 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-07-25 15:25 - 2014-08-13 07:29 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-07-25 14:59 - 2014-08-13 07:29 - 00758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-07-25 14:40 - 2014-08-13 07:29 - 00452096 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2014-07-25 14:34 - 2014-08-13 07:29 - 00455168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-07-25 14:30 - 2014-08-13 07:29 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-07-25 14:28 - 2014-08-13 07:29 - 05824512 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-07-25 14:28 - 2014-08-13 07:29 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\JavaScriptCollectionAgent.dll
2014-07-25 14:21 - 2014-08-13 07:29 - 02184704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-07-25 14:17 - 2014-08-13 07:29 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-07-25 14:10 - 2014-08-13 07:29 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-07-25 14:08 - 2014-08-13 07:29 - 00597504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2014-07-25 14:06 - 2014-08-13 07:29 - 04204032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-07-25 13:52 - 2014-08-13 07:29 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2014-07-25 13:47 - 2014-08-13 07:29 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-07-25 13:43 - 2014-08-13 07:29 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-07-25 13:43 - 2014-08-13 07:29 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-25 13:42 - 2014-08-13 07:29 - 00692736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-07-25 13:39 - 2014-08-13 07:29 - 02087936 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-07-25 13:34 - 2014-08-13 07:29 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-07-25 13:29 - 2014-08-13 07:29 - 00239616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-07-25 13:23 - 2014-08-13 07:29 - 13547008 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-07-25 13:13 - 2014-08-13 07:29 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-07-25 13:09 - 2014-08-13 07:29 - 00291840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-07-25 13:07 - 2014-08-13 07:29 - 02001920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-07-25 13:03 - 2014-08-13 07:29 - 11772928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-07-25 12:52 - 2014-08-13 07:29 - 02266624 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-07-25 12:26 - 2014-08-13 07:29 - 01431040 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-07-25 12:17 - 2014-08-13 07:29 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-07-25 12:09 - 2014-08-13 07:29 - 00704512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-07-25 12:05 - 2014-08-13 07:29 - 01792512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-07-25 12:00 - 2014-08-13 07:29 - 01169920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

Some content of TEMP:
====================
C:\Users\Jutta\AppData\Local\Temp\58250uninstall.exe
C:\Users\Jutta\AppData\Local\Temp\a2zLyrics_1060-8102_v122.exe
C:\Users\Jutta\AppData\Local\Temp\appshat-distribution.exe
C:\Users\Jutta\AppData\Local\Temp\avgnt.exe
C:\Users\Jutta\AppData\Local\Temp\BackupSetup.exe
C:\Users\Jutta\AppData\Local\Temp\COMAP.EXE
C:\Users\Jutta\AppData\Local\Temp\EADB850.exe
C:\Users\Jutta\AppData\Local\Temp\EADB8DE.exe
C:\Users\Jutta\AppData\Local\Temp\EADE272.exe
C:\Users\Jutta\AppData\Local\Temp\extension1198965671026689626.dll
C:\Users\Jutta\AppData\Local\Temp\extension3468924565051178888.dll
C:\Users\Jutta\AppData\Local\Temp\extension3919176333743683483.dll
C:\Users\Jutta\AppData\Local\Temp\extension4520323638078928898.dll
C:\Users\Jutta\AppData\Local\Temp\extension4544361943483554033.dll
C:\Users\Jutta\AppData\Local\Temp\extension5106180114494202662.dll
C:\Users\Jutta\AppData\Local\Temp\extension5158680092704645210.dll
C:\Users\Jutta\AppData\Local\Temp\extension5940112321691308842.dll
C:\Users\Jutta\AppData\Local\Temp\extension8257857011519117102.dll
C:\Users\Jutta\AppData\Local\Temp\extension8858833335510847471.dll
C:\Users\Jutta\AppData\Local\Temp\fam-installer.exe
C:\Users\Jutta\AppData\Local\Temp\fmp-2.0.7-win32.exe
C:\Users\Jutta\AppData\Local\Temp\MoviesToolbarSetup_Somoto_9_10_2013.exe
C:\Users\Jutta\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Jutta\AppData\Local\Temp\ose00000.exe
C:\Users\Jutta\AppData\Local\Temp\Quarantine.exe
C:\Users\Jutta\AppData\Local\Temp\sp-latest.exe
C:\Users\Jutta\AppData\Local\Temp\Sqlite3.dll
C:\Users\Jutta\AppData\Local\Temp\SRLDetectionLibrary2591113819306373289.dll
C:\Users\Jutta\AppData\Local\Temp\UninstallEADM.dll
C:\Users\Jutta\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\Jutta\AppData\Local\Temp\vpnclient_setup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-16 21:42

==================== End Of Log ============================

--- --- ---

Bootsektor · 23.08.2014, 21:04

Hallo,

sehr gut

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
FF Extension: No Name - C:\WINDOWS\Installer\{2BBB60CE-AE68-4CEB-BAE3-3A139930D9D5}\{C17606FE-6872-4033-B125-AEDC5E3F233A}.xpi []
CHR Extension: (Download Protect) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\hialmlehfaanlffiliclpacmihbfdkpl [2014-08-22]
Task: {31C54016-63C9-4A1E-98E5-886EBC7BB47D} - \a2zLyrics-16-updater No Task File <==== ATTENTION
Task: {3DA36C08-668B-4003-8655-9BA5D1ED0E1F} - \a2zLyrics-16-chromeinstaller No Task File <==== ATTENTION
Task: {580813B3-FEB5-4195-9E1E-10F701DB7A85} - \a2zLyrics-16-enabler No Task File <==== ATTENTION
Task: {5E2FC257-2E29-478E-9D8B-E2551FF818D8} - \a2zLyrics-16-codedownloader No Task File <==== ATTENTION
Task: {A7220801-FF0B-4DB1-B491-6A2D4D2899DF} - System32\Tasks\FileAssociationManagerUpdater => C:\Program Files (x86)\FileAssociationManager\Updater.exe
Task: {3DA36C08-668B-4003-8655-9BA5D1ED0E1F} - \a2zLyrics-16-chromeinstaller No Task File <==== ATTENTION
Task: {580813B3-FEB5-4195-9E1E-10F701DB7A85} - \a2zLyrics-16-enabler No Task File <==== ATTENTION
Task: {5E2FC257-2E29-478E-9D8B-E2551FF818D8} - \a2zLyrics-16-codedownloader No Task File <==== ATTENTION
Task: {A7220801-FF0B-4DB1-B491-6A2D4D2899DF} - System32\Tasks\FileAssociationManagerUpdater => C:\Program Files (x86)\FileAssociationManager\Updater.exe
Task: {F19DE44C-1993-4C51-8962-BAFA6946A7E8} - \CreateChoiceProcessTask No Task File <==== ATTENTION
C:\WINDOWS\Installer\{2BBB60CE-AE68-4CEB-BAE3-3A139930D9D5}\{C17606FE-6872-4033-B125-AEDC5E3F233A}.xpi []
C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\hialmlehfaanlffiliclpacmihbfdkpl
C:\Program Files (x86)\FileAssociationManager

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2
Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.

Klicke auf Wählen Sie eine
Kopiere nun folgendes in die Suchleiste
Code:
ATTFilter
```
C:\WINDOWS\UOINSTLMv7.EXE
         
```
und klicke auf Öffnen.
Klicke auf Scannen!.
Warte bitte bis die Datei vollständig hochgeladen wurde. Solltest Du folgende Meldung bekommen

Zitat:

Diese Datei wurde bereits von VirusTotal analysiert...

klicke auf Neu analysieren.
Warte bis dir das Analysedatum angezeigt wird und der Scan abgeschlossen ist.
Kopiere den Link aus deiner Adresszeile und poste ihn hier.

Schritt 3

Deaktiviere dein Anti-Viren-Programm.
Gehe zum Ordner C:\FRST\Quarantine.
Rechtsklicke auf den Ordner Quarantine und wähle > Senden an > Zip-komprimierter Ordner.
Es wird eine zip-Datei mit dem Namen Quarantine.zip im Ordner FRST erstellt.
Lade die Quarantine.zip im Upload-Channel hoch.
Klicke dazu auf Durchsuchen, navigiere zu der zip-Datei ( C:\FRST\Quarantine.zip ) und klicke auf Öffnen.
Klicke abschließend auf Hochladen.
Vielen Dank für deine Hilfe.
Aktiviere dein Anti-Viren-Programm wieder.

JuttaS. · 03.09.2014, 14:33

Hat etwas gedauert, war im Urlaub

Hier die Sachen:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-09-2014 01
Ran by Jutta at 2014-09-03 15:16:45 Run:1
Running from C:\Users\Jutta\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
FF Extension: No Name - C:\WINDOWS\Installer\{2BBB60CE-AE68-4CEB-BAE3-3A139930D9D5}\{C17606FE-6872-4033-B125-AEDC5E3F233A}.xpi []
CHR Extension: (Download Protect) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\hialmlehfaanlffiliclpacmihbfdkpl [2014-08-22]
Task: {31C54016-63C9-4A1E-98E5-886EBC7BB47D} - \a2zLyrics-16-updater No Task File <==== ATTENTION
Task: {3DA36C08-668B-4003-8655-9BA5D1ED0E1F} - \a2zLyrics-16-chromeinstaller No Task File <==== ATTENTION
Task: {580813B3-FEB5-4195-9E1E-10F701DB7A85} - \a2zLyrics-16-enabler No Task File <==== ATTENTION
Task: {5E2FC257-2E29-478E-9D8B-E2551FF818D8} - \a2zLyrics-16-codedownloader No Task File <==== ATTENTION
Task: {A7220801-FF0B-4DB1-B491-6A2D4D2899DF} - System32\Tasks\FileAssociationManagerUpdater => C:\Program Files (x86)\FileAssociationManager\Updater.exe
Task: {3DA36C08-668B-4003-8655-9BA5D1ED0E1F} - \a2zLyrics-16-chromeinstaller No Task File <==== ATTENTION
Task: {580813B3-FEB5-4195-9E1E-10F701DB7A85} - \a2zLyrics-16-enabler No Task File <==== ATTENTION
Task: {5E2FC257-2E29-478E-9D8B-E2551FF818D8} - \a2zLyrics-16-codedownloader No Task File <==== ATTENTION
Task: {A7220801-FF0B-4DB1-B491-6A2D4D2899DF} - System32\Tasks\FileAssociationManagerUpdater => C:\Program Files (x86)\FileAssociationManager\Updater.exe
Task: {F19DE44C-1993-4C51-8962-BAFA6946A7E8} - \CreateChoiceProcessTask No Task File <==== ATTENTION
C:\WINDOWS\Installer\{2BBB60CE-AE68-4CEB-BAE3-3A139930D9D5}\{C17606FE-6872-4033-B125-AEDC5E3F233A}.xpi []
C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\hialmlehfaanlffiliclpacmihbfdkpl
C:\Program Files (x86)\FileAssociationManager
*****************

C:\WINDOWS\system32\GroupPolicy\Machine => Moved successfully.
C:\WINDOWS\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
C:\WINDOWS\Installer\{2BBB60CE-AE68-4CEB-BAE3-3A139930D9D5}\{C17606FE-6872-4033-B125-AEDC5E3F233A}.xpi not found.
C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\hialmlehfaanlffiliclpacmihbfdkpl => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{31C54016-63C9-4A1E-98E5-886EBC7BB47D}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{31C54016-63C9-4A1E-98E5-886EBC7BB47D}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\a2zLyrics-16-updater" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3DA36C08-668B-4003-8655-9BA5D1ED0E1F}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3DA36C08-668B-4003-8655-9BA5D1ED0E1F}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\a2zLyrics-16-chromeinstaller" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{580813B3-FEB5-4195-9E1E-10F701DB7A85}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{580813B3-FEB5-4195-9E1E-10F701DB7A85}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\a2zLyrics-16-enabler" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{5E2FC257-2E29-478E-9D8B-E2551FF818D8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5E2FC257-2E29-478E-9D8B-E2551FF818D8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\a2zLyrics-16-codedownloader" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A7220801-FF0B-4DB1-B491-6A2D4D2899DF}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A7220801-FF0B-4DB1-B491-6A2D4D2899DF}" => Key deleted successfully.
C:\Windows\System32\Tasks\FileAssociationManagerUpdater => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FileAssociationManagerUpdater" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3DA36C08-668B-4003-8655-9BA5D1ED0E1F}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\a2zLyrics-16-chromeinstaller" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{580813B3-FEB5-4195-9E1E-10F701DB7A85}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\a2zLyrics-16-enabler" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5E2FC257-2E29-478E-9D8B-E2551FF818D8}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\a2zLyrics-16-codedownloader" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A7220801-FF0B-4DB1-B491-6A2D4D2899DF}" => Key not found.
C:\Windows\System32\Tasks\FileAssociationManagerUpdater not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FileAssociationManagerUpdater" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F19DE44C-1993-4C51-8962-BAFA6946A7E8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F19DE44C-1993-4C51-8962-BAFA6946A7E8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\CreateChoiceProcessTask" => Key deleted successfully.
"C:\WINDOWS\Installer\{2BBB60CE-AE68-4CEB-BAE3-3A139930D9D5}\{C17606FE-6872-4033-B125-AEDC5E3F233A}.xpi []" => File/Directory not found.
"C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\hialmlehfaanlffiliclpacmihbfdkpl" => File/Directory not found.
C:\Program Files (x86)\FileAssociationManager => Moved successfully.


The system needed a reboot. 

==== End of Fixlog ====

https://www.virustotal.com/de/file/2ae643f427f7a5906a0d8decffb46069b319bbea25dead410df9a4d840beb209/analysis/1409750789/

Wenn ich auf "Senden an" drücke kommt das mit dem zip ordner nicht. Kann ich den auch irgendwie anders erstellen?

Bootsektor · 03.09.2014, 23:01

Hallo Jutta,

ich hoffe du hattest einen schönen Urlaub.

Es sieht so aus, als hättest du die verkehrte Datei zu virustotal geschickt, kannst du den Schritt 2 bitte nochmals versuchen?

zu Schritt 3
Wähle mal bitte den Ordner C:\FRST\Quarantine aus dann müsstest du dort eine Option sehen die Freigeben heißt, wähle diese an und gehe dann auf zippen, folge dann den weiteren Punkten der Anleitung

22.08.2014, 12:17	#7
Bootsektor Ruhe in Frieden † 2019	Chrome Erweiterung "Download Protect 2.2.5" lässt sich nicht entfernen Und das war auch wirklich der Adwarecleaner, der das gefunden hat und nichts weiteres? Kannst du bitte das Suchlog posten? __________________ Grüße stolzes Mitglied von UNITE Du hast Lob oder Verbesserungsvorschläge? Du findest unsere Arbeit gut und möchtest uns finanziell unterstützen? -> Spende

22.08.2014, 21:23	#9
Bootsektor Ruhe in Frieden † 2019	Chrome Erweiterung "Download Protect 2.2.5" lässt sich nicht entfernen Ok, dann bitte alles löschen lassen und ein neues Log von FRST, hake das Feld addition.txt an. __________________ Grüße stolzes Mitglied von UNITE Du hast Lob oder Verbesserungsvorschläge? Du findest unsere Arbeit gut und möchtest uns finanziell unterstützen? -> Spende

Chrome Erweiterung "Download Protect 2.2.5" lässt sich nicht entfernen

Log-Analyse und Auswertung: Chrome Erweiterung "Download Protect 2.2.5" lässt sich nicht entfernen