Hallo,

ich habe mir heute das Programm Virtual Router Plus gedownloadet und mir bei der Installation leider einiges an Adware eingefangen. Bis jetzt habe ich schon einiges mit adwcleaner und Malwarebytes entfernen lassen, ich bin mir aber nicht sicher, ob wirklich alles entfernt wurde.
Könntet ihr mir bitte dabei helfen, den Laptop vollständig zu bereinigen?

Hier die Logs von adwcleaner und Malwarebytes

# AdwCleaner v4.000 - Bericht erstellt am 14/10/2014 um 20:01:31
# DB v2014-10-14.6
# Aktualisiert 12/10/2014 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : *** - IDEA-PC
# Gestartet von : C:\Users\***\Desktop\adwcleaner_4.000.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\Users\***~1\AppData\Local\Temp\apn
Ordner Gelöscht : C:\Program Files (x86)\globalUpdate
Ordner Gelöscht : C:\Users\***\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\Public\Documents\Goobzo
Ordner Gelöscht : C:\Program Files (x86)\iWebar
Ordner Gelöscht : C:\Users\***~1\AppData\Local\Temp\PodoWeb
Ordner Gelöscht : C:\Users\Public\Documents\ShopperPro
Ordner Gelöscht : C:\Program Files (x86)\YouTube Accelerator
Ordner Gelöscht : C:\Users\Public\Documents\YTAHelper
Datei Gelöscht : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\user.js

***** [ Tasks ] *****

Task Gelöscht : 3dabfa42-13fd-4c48-8a68-743d135d1d2f-2
Task Gelöscht : 3dabfa42-13fd-4c48-8a68-743d135d1d2f-5
Task Gelöscht : 3dabfa42-13fd-4c48-8a68-743d135d1d2f-5_user

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ShopperPro.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110611511123}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622512223}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655515523}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666516623}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440644514423}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611511123}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{41564952-412D-5637-00A7-7A786E7484D7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110611511123}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110611511123}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{41564952-412D-5637-00A7-7A786E7484D7}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110611511123}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622512223}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655515523}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666516623}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611511123}
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\Goobzo
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\iWebar
Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\Goobzo
Schlüssel Gelöscht : HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : HKLM\SOFTWARE\iWebar
Schlüssel Gelöscht : HKLM\SOFTWARE\Myfree Codec
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\ShopperPro

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


-\\ Mozilla Firefox v32.0.3 (x86 de)


-\\ Google Chrome v37.0.2062.124


*************************

AdwCleaner[R0].txt - [6719 octets] - [14/10/2014 20:00:09]
AdwCleaner[S0].txt - [6060 octets] - [14/10/2014 20:01:31]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6120 octets] ##########
         

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 14.10.2014
Suchlauf-Zeit: 20:05:49
Logdatei: 1.txt
Administrator: Ja

Version: 2.00.3.1025
Malware Datenbank: v2014.10.14.11
Rootkit Datenbank: v2014.10.11.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8
CPU: x64
Dateisystem: NTFS
Benutzer: ***

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 325129
Verstrichene Zeit: 16 Min, 31 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 2
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 2
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.319719, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.416058, In Quarantäne, [6b3867ad97e5b87ec97f3fc455aebd43], 

Dateien: 31
PUP.Optional.Senses.A, C:\Users\***\AppData\Roaming\CLQHUO.exe, In Quarantäne, [faa951c303797fb7a1182b8a877ac33d], 
PUP.Optional.Senses.A, C:\Users\***\AppData\Roaming\UACO.exe, In Quarantäne, [a9fad53f186454e27e3b862f3ac7817f], 
PUP.Optional.Somoto.A, C:\$Recycle.Bin\S-1-5-21-1429691773-2651506096-3644874853-1002\$R4GVSSM.exe, In Quarantäne, [bee5e232522a0a2c6cd4be7a9d639d63], 
PUP.Optional.Somoto, C:\Users\***\AppData\Local\Temp\UpdateCheckerSetup.exe, In Quarantäne, [d6cd40d4c8b4092dce5d37f08f71be42], 
PUP.Optional.BPlug, C:\Users\***\AppData\Local\Temp\setup.exe, In Quarantäne, [edb646ce275544f2aea699252ad79d63], 
PUP.Optional.Somoto.A, C:\Users\***\AppData\Local\Temp\appshat_generic.exe, In Quarantäne, [198abd5739430b2bc9911e047c8406fa], 
PUP.Optional.SearchProtect.A, C:\Users\***\AppData\Local\Temp\sp-downloader.exe, In Quarantäne, [d7cc62b28def8caa8af0c2d3a85929d7], 
PUP.Optional.CrossRider, C:\Users\***\AppData\Local\Temp\Install_27689\iwebar.exe, In Quarantäne, [b3f029ebe399d660a29abc12da279c64], 
PUP.Optional.CrossRider, C:\Users\***\AppData\Local\Temp\Install_30241\sense.exe, In Quarantäne, [238068aca3d9d36343f98a44d8298d73], 
PUP.Optional.OpenCandy, C:\Users\***\Downloads\setupimgburn_25498.exe, In Quarantäne, [287b9c78d8a445f14dd0ee577392c13f], 
Trojan.FakeAlert, C:\Users\***\AppData\Roaming\UACO.exe, In Quarantäne, [7e254dc75725cd69a635a0c8dc274eb2], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.319719\GoogleCrashHandler.exe, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.319719\GoogleUpdate.exe, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.319719\GoogleUpdateBroker.exe, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.319719\GoogleUpdateHelper.msi, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.319719\GoogleUpdateOnDemand.exe, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.319719\goopdate.dll, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.319719\goopdateres_en.dll, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.319719\npGoogleUpdate4.dll, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.319719\psmachine.dll, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.319719\psuser.dll, In Quarantäne, [267dcd4734480c2af15706fde61de11f], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.416058\GoogleCrashHandler.exe, In Quarantäne, [6b3867ad97e5b87ec97f3fc455aebd43], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.416058\GoogleUpdate.exe, In Quarantäne, [6b3867ad97e5b87ec97f3fc455aebd43], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.416058\GoogleUpdateBroker.exe, In Quarantäne, [6b3867ad97e5b87ec97f3fc455aebd43], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.416058\GoogleUpdateHelper.msi, In Quarantäne, [6b3867ad97e5b87ec97f3fc455aebd43], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.416058\GoogleUpdateOnDemand.exe, In Quarantäne, [6b3867ad97e5b87ec97f3fc455aebd43], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.416058\goopdate.dll, In Quarantäne, [6b3867ad97e5b87ec97f3fc455aebd43], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.416058\goopdateres_en.dll, In Quarantäne, [6b3867ad97e5b87ec97f3fc455aebd43], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.416058\npGoogleUpdate4.dll, In Quarantäne, [6b3867ad97e5b87ec97f3fc455aebd43], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.416058\psmachine.dll, In Quarantäne, [6b3867ad97e5b87ec97f3fc455aebd43], 
PUP.Optional.GlobalUpdate.A, C:\Users\***\AppData\Local\Temp\comh.416058\psuser.dll, In Quarantäne, [6b3867ad97e5b87ec97f3fc455aebd43], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         

Hier noch die Logs vom FRST-Scan:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-10-2014 02
Ran by *** (administrator) on IDEA-PC on 14-10-2014 20:54:48
Running from C:\Users\***\Desktop
Loaded Profile: *** (Available profiles: ***)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
() C:\Program Files (x86)\A1 Dashboard\A1Dashboard_Service.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Lenovo) C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Vimicro) C:\Program Files (x86)\USB Camera2\VM332STI.EXE
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Microsoft) C:\Program Files (x86)\Lenovo\Intelligent Touchpad\IntelligentTouchpad.exe
(BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
() C:\Program Files (x86)\A1 Dashboard\A1Dashboard_Launcher.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(WebToGo Gmbh) C:\Program Files (x86)\A1 Dashboard\A1Dashboard.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-27] (Synaptics Incorporated)
HKLM\...\Run: [SynLenovoGestureMgr] => C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe [665400 2012-08-27] (Synaptics)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12921488 2012-09-14] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-09-14] (Realtek Semiconductor)
HKLM\...\Run: [OnekeyStudio] => C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe [4196432 2012-08-10] (Lenovo)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17080376 2012-11-21] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [191544 2012-11-21] (Lenovo(beijing) Limited)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2460488 2014-09-17] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [332BigDog] => C:\Program Files (x86)\USB Camera2\VM332STI.EXE [548864 2012-03-20] (Vimicro)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2012-07-27] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167024 2012-07-27] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [217088 2012-04-18] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
HKLM-x32\...\Run: [IntellingentTouchpad] => C:\Program Files (x86)\Lenovo\Intelligent Touchpad\IntelligentTouchpad.exe [673336 2012-07-23] (Microsoft)
HKLM-x32\...\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe [384232 2012-07-13] (BillP Studios)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [TAG_A1Dashboard_Launcher.exe] => C:\Program Files (x86)\A1 Dashboard\A1Dashboard_Launcher.exe [531000 2013-07-03] ()
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-19] (Apple Inc.)
HKLM-x32\...\Run: [TAG_A1Dashboard.exe] => C:\Program Files (x86)\A1 Dashboard\A1Dashboard.exe [4303416 2013-07-03] (WebToGo Gmbh)
HKLM-x32\...\Run: [AllShareAgent] => C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe [284560 2011-12-16] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [310064 2014-06-14] (Samsung Electronics Co., Ltd.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1939136 2014-08-28] (Valve Corporation)
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [784392 2014-05-29] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\Run: [SecureBanking] => C:\Program Files (x86)\Secure Banking\SecureBanking.exe [507904 2014-06-25] (Secure Banking)
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\RunOnce: [Uninstall C:\Users\***\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\***\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64"
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\MountPoints2: {061d3b13-010c-11e3-be79-e006e6bf8c1d} - "F:\Autorun.exe" 
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\MountPoints2: {061d3c21-010c-11e3-be79-e006e6bf8c1d} - "F:\Autorun.exe" 
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\MountPoints2: {061d3d18-010c-11e3-be79-e006e6bf8c1d} - "F:\Autorun.exe" 
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\MountPoints2: {e2341cd7-3254-11e3-beae-e006e6bf8c1d} - "F:\Autorun.exe" 
HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
AppInit_DLLs: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [156840 2014-09-14] (NVIDIA Corporation)
AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [174856 2014-09-14] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [156840 2014-09-14] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKLM - {0F3A5A72-ACBB-42CE-AD65-46AFF64C341A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
SearchScopes: HKLM-x32 - {0F3A5A72-ACBB-42CE-AD65-46AFF64C341A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
SearchScopes: HKCU - DefaultScope {0F3A5A72-ACBB-42CE-AD65-46AFF64C341A} URL = 
SearchScopes: HKCU - {0F3A5A72-ACBB-42CE-AD65-46AFF64C341A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: No Name -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} ->  No File
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default
FF Homepage: https://www.google.at/
FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3522.0110 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\***\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\searchplugins\ponseu--russisch--deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: HTTPS-Everywhere - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\Extensions\https-everywhere@eff.org [2014-09-12]
FF Extension: Advertising Cookie Opt-out - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\Extensions\optout@google.com [2013-08-09]
FF Extension: WOT - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-27]
FF Extension: Media Hint - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\Extensions\mediahint@jetpack.xpi [2014-04-09]
FF Extension: NoScript - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-08-09]
FF Extension: Adblock Plus - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-09]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
CHR HomePage: Default -> 
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\***\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.4.600\_platform_specific\win_x86\widevinecdmadapter.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\pdf.dll ()
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.670.1) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U67) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Microsoft Office 2013) - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\***\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave Flash) - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
CHR Profile: C:\Users\***\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Media Hint) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\akipcefbjlmpbcejgdaopmmidpnjlhnb [2014-04-14]
CHR Extension: (Google Docs) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-11]
CHR Extension: (Google Drive) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-11]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-03]
CHR Extension: (YouTube) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-11]
CHR Extension: (Adblock Plus) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-07-31]
CHR Extension: (Google-Suche) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-11]
CHR Extension: (ProxMate Beta) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkijfpdhghdgfjcabjelbmmoocpefnih [2014-07-28]
CHR Extension: (Stop Autoplay for Youtube™ Extended) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\nilnpbhnhmmjioijfgilcohbknkgfmpa [2014-08-03]
CHR Extension: (Google Wallet) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-11]
CHR Extension: (Google Mail) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-11]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252088 2012-08-25] (Broadcom Corporation.)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [957304 2012-09-06] (Broadcom Corporation.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2428088 2014-08-12] (Microsoft Corporation)
R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-03-30] (Diskeeper Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2014-09-17] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [7168 2012-08-16] (Intel Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-07-18] ()
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-09-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19439944 2014-09-17] (NVIDIA Corporation)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [174088 2014-05-29] (Sandboxie Holdings, LLC)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation)
R2 TAG_Service; C:\Program Files (x86)\A1 Dashboard\A1Dashboard_Service.exe [510520 2013-07-03] ()
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2699568 2012-07-18] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [165688 2012-08-25] (Broadcom Corporation.)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-03-30] (Diskeeper Corporation)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [95024 2012-03-30] (Diskeeper Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-14] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [4273192 2012-08-19] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19272 2014-09-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [185352 2014-05-29] (Sandboxie Holdings, LLC)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-27] (Synaptics Incorporated)
S3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [48096 2012-08-09] (Windows (R) Win 7 DDK provider)
S3 usbrndis6; C:\Windows\system32\DRIVERS\usb80236.sys [20992 2013-02-12] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188384 2012-08-09] (Windows (R) Win 7 DDK provider)
S3 huawei_enumerator; \SystemRoot\System32\drivers\ew_jubusenum.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2040-02-06 05:28 - 2010-09-05 10:16 - 126165556 _____ () C:\Users\***\Documents\PONS Spanisch.ipa
2014-10-14 20:54 - 2014-10-14 20:55 - 00028025 _____ () C:\Users\***\Desktop\FRST.txt
2014-10-14 20:54 - 2014-10-14 20:54 - 00000480 _____ () C:\Users\***\Desktop\defogger_disable.log
2014-10-14 20:54 - 2014-10-14 20:54 - 00000000 ____D () C:\FRST
2014-10-14 20:54 - 2014-10-14 20:54 - 00000000 _____ () C:\Users\***\defogger_reenable
2014-10-14 20:22 - 2014-10-14 20:22 - 00006207 _____ () C:\Users\***\Desktop\1.txt
2014-10-14 20:10 - 2014-10-14 20:10 - 00380416 _____ () C:\Users\***\Desktop\Gmer-19357.exe
2014-10-14 20:09 - 2014-10-14 20:09 - 00050477 _____ () C:\Users\***\Desktop\Defogger.exe
2014-10-14 20:08 - 2014-10-14 20:08 - 02110464 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe
2014-10-14 20:05 - 2014-10-14 20:26 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-10-14 20:05 - 2014-10-14 20:05 - 00001117 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-14 20:05 - 2014-10-14 20:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-14 20:05 - 2014-10-14 20:05 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-14 20:05 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-10-14 20:05 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-10-14 20:05 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-10-14 20:04 - 2014-10-14 20:04 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\***\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-14 20:03 - 2014-10-14 20:03 - 00006252 _____ () C:\Users\***\Desktop\AdwCleaner[S0].txt
2014-10-14 20:00 - 2014-10-14 20:01 - 00000000 ____D () C:\AdwCleaner
2014-10-14 19:59 - 2014-10-14 19:59 - 01976320 _____ () C:\Users\***\Desktop\adwcleaner_4.000.exe
2014-10-14 19:57 - 2014-10-14 19:57 - 00000000 ____D () C:\Users\***\AppData\Local\VS Revo Group
2014-10-14 19:57 - 2014-10-14 19:57 - 00000000 ____D () C:\ProgramData\VS Revo Group
2014-10-14 19:56 - 2014-10-14 19:57 - 10691640 _____ (VS Revo Group ) C:\Users\***\Downloads\RevoUninProSetup.exe
2014-10-14 19:37 - 2014-10-14 20:24 - 00001370 _____ () C:\WINDOWS\Tasks\CLQHUO.job
2014-10-14 19:37 - 2014-10-14 19:37 - 00004384 _____ () C:\WINDOWS\System32\Tasks\CLQHUO
2014-10-14 19:34 - 2014-10-14 20:24 - 00001366 _____ () C:\WINDOWS\Tasks\UACO.job
2014-10-14 19:34 - 2014-10-14 19:34 - 00004378 _____ () C:\WINDOWS\System32\Tasks\UACO
2014-10-14 19:15 - 2014-10-14 19:15 - 00000000 ____D () C:\Users\***\AppData\Local\VirtualRouterPlus
2014-10-14 19:12 - 2014-10-14 19:12 - 00000000 ____D () C:\Users\***\AppData\Local\CrashRpt
2014-10-14 19:07 - 2014-10-14 19:07 - 00000000 ____D () C:\Users\***\Downloads\nw_29531_virtualrouterplusset
2014-10-14 12:25 - 2014-10-14 12:25 - 00211263 _____ () C:\Users\***\Desktop\Ask Ovi.pptx
2014-10-13 23:41 - 2014-10-13 23:41 - 00042152 _____ (Connectify) C:\WINDOWS\system32\Drivers\cnnctfy3.sys
2014-10-12 14:52 - 2014-10-12 14:52 - 00001122 _____ () C:\Users\***\Desktop\Katawa Shoujo.lnk
2014-10-12 14:52 - 2014-10-12 14:52 - 00000000 ____D () C:\Program Files (x86)\Katawa Shoujo
2014-10-12 14:46 - 2014-10-12 14:51 - 448764288 _____ () C:\Users\***\Downloads\[4ls]_katawa_shoujo_1.2-[windows][64ECD9F9].exe
2014-10-11 11:47 - 2014-10-11 11:47 - 00007063 _____ () C:\Users\***\Desktop\BU4511 Int. Business & Global Economy - Verknüpfung.lnk
2014-10-11 11:47 - 2014-10-11 11:47 - 00007059 _____ () C:\Users\***\Desktop\EC4100 International Economics, Trade - Verknüpfung.lnk
2014-10-11 11:47 - 2014-10-11 11:47 - 00006958 _____ () C:\Users\***\Desktop\BU3600 New Venture Development - Verknüpfung.lnk
2014-10-11 11:47 - 2014-10-11 11:47 - 00006849 _____ () C:\Users\***\Desktop\EC3030 European Economy - Verknüpfung.lnk
2014-10-11 11:47 - 2014-10-11 11:47 - 00006838 _____ () C:\Users\***\Desktop\BU3541 Applied Finance - Verknüpfung.lnk
2014-10-09 18:24 - 2014-10-09 19:22 - 00001132 _____ () C:\Users\Public\Desktop\Dragon Age Origins.lnk
2014-10-09 18:24 - 2014-10-09 18:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dragon Age Origins
2014-10-07 13:00 - 2014-10-07 13:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2014-10-05 23:38 - 2014-10-05 23:39 - 00304280 _____ () C:\WINDOWS\Minidump\100514-36468-01.dmp
2014-10-05 03:37 - 2014-10-05 03:37 - 00000000 ____D () C:\Users\***\AppData\Local\Chris_Pietschmann_(http__
2014-10-04 19:09 - 2014-10-05 23:36 - 00000518 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.ics
2014-10-04 19:03 - 2014-10-14 19:23 - 00000000 ____D () C:\Program Files (x86)\Virtual Router
2014-10-04 19:02 - 2014-10-04 19:02 - 01101648 _____ () C:\Users\***\Downloads\Virtual Router - CHIP-Installer.exe
2014-10-03 16:50 - 2014-10-03 16:50 - 00001678 _____ () C:\Users\Public\Desktop\Goodbye Deponia.lnk
2014-10-03 16:50 - 2014-10-03 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Goodbye Deponia [GOG.com]
2014-09-29 17:49 - 2014-09-29 17:49 - 00000000 ____D () C:\WINDOWS\SysWOW64\NV
2014-09-29 17:49 - 2014-09-29 17:49 - 00000000 ____D () C:\WINDOWS\system32\NV
2014-09-29 17:49 - 2014-09-29 17:49 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-09-29 17:48 - 2014-09-14 00:48 - 31887680 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 24552592 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 20922512 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcompiler.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 20589536 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvwgf2umx.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 19954520 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvd3dumx.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 17259664 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcompiler.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 14026304 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 13939272 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 13157696 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvlddmkm.sys
2014-09-29 17:48 - 2014-09-14 00:48 - 11392576 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 11330776 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 04287296 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 04008592 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 01876296 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6434411.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 01539272 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6434411.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00957584 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00925896 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00919240 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00894096 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00501064 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00417096 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00393024 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00352016 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglshim64.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00348304 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00303600 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglshim32.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00032576 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvpciflt.sys
2014-09-29 17:42 - 2014-09-29 17:48 - 00000000 ____D () C:\WINDOWS\LastGood.Tmp
2014-09-29 17:42 - 2014-09-04 20:14 - 00038048 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvad64v.sys
2014-09-29 17:42 - 2014-09-04 20:14 - 00032416 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll
2014-09-28 17:59 - 2014-10-09 22:40 - 00012043 _____ () C:\Users\***\Desktop\Long live the queen.odt
2014-09-28 11:52 - 2014-09-28 11:52 - 00000000 ____D () C:\Users\***\AppData\Roaming\com.geetagames.LillyLookingThrough
2014-09-28 11:43 - 2014-09-28 11:43 - 00000000 ____D () C:\Users\***\Downloads\LongLiveTheQueenRetail-1.2.25-win32
2014-09-28 11:42 - 2014-09-28 11:43 - 50610156 _____ () C:\Users\***\Downloads\LongLiveTheQueen-1.2.25_win32_1411580325.zip
2014-09-28 11:32 - 2014-09-28 11:32 - 00000000 ____D () C:\Users\***\Downloads\Glitchhikers
2014-09-28 11:32 - 2014-09-28 11:32 - 00000000 ____D () C:\Users\***\Downloads\__MACOSX
2014-09-25 10:14 - 2014-09-25 10:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-22 21:26 - 2014-09-22 21:27 - 67111021 _____ () C:\Users\***\Downloads\GlitchhikersRelease-Win.zip
2014-09-21 18:34 - 2014-09-21 18:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-19 20:18 - 2014-09-19 20:18 - 00292648 _____ () C:\WINDOWS\Minidump\091914-22234-01.dmp
2014-09-15 14:22 - 2014-09-15 14:22 - 00000000 ____D () C:\WINDOWS\SysWOW64\0409
2014-09-15 14:21 - 2014-09-15 14:21 - 00000000 ____D () C:\WINDOWS\system32\0409
2014-09-14 13:35 - 2014-09-14 13:35 - 00303576 _____ () C:\WINDOWS\Minidump\091414-25421-01.dmp
2014-09-14 13:14 - 2014-09-14 13:14 - 00002007 _____ () C:\Users\Public\Desktop\Samsung Kies.lnk
2014-09-14 13:14 - 2014-09-14 13:14 - 00000000 ____D () C:\Users\***\Documents\samsung
2014-09-14 13:14 - 2014-09-14 13:14 - 00000000 ____D () C:\Users\***\AppData\Local\Samsung
2014-09-14 13:14 - 2014-09-14 13:14 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-09-14 13:08 - 2014-04-30 19:43 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll
2014-09-14 13:08 - 2014-04-30 19:43 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\WINDOWS\SysWOW64\secman.dll
2014-09-14 13:07 - 2014-09-14 13:08 - 00000000 ____D () C:\ProgramData\Samsung
2014-09-14 13:05 - 2014-09-14 13:06 - 75714480 _____ (Samsung Electronics Co., Ltd.) C:\Users\***\Downloads\KiesSetup.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-14 20:54 - 2013-08-09 12:10 - 00000000 ____D () C:\Users\***
2014-10-14 20:38 - 2013-08-09 12:16 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1429691773-2651506096-3644874853-1002
2014-10-14 20:34 - 2012-11-21 09:48 - 01668324 _____ () C:\WINDOWS\WindowsUpdate.log
2014-10-14 20:24 - 2014-04-14 11:40 - 00001128 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-14 20:24 - 2013-11-27 21:18 - 00065536 _____ () C:\WINDOWS\system32\Ikeext.etl
2014-10-14 20:24 - 2012-10-10 00:08 - 00173248 _____ () C:\WINDOWS\PFRO.log
2014-10-14 20:24 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\tracing
2014-10-14 20:24 - 2012-07-26 08:22 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-10-14 20:10 - 2014-01-30 11:48 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-10-14 20:03 - 2014-04-14 11:40 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-14 20:01 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-10-14 19:39 - 2012-11-21 09:37 - 00000000 ____D () C:\ProgramData\Temp
2014-10-14 19:38 - 2013-08-09 13:45 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster
2014-10-14 19:19 - 2012-07-26 09:12 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-10-14 19:19 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\SysWOW64\GroupPolicy
2014-10-14 19:12 - 2013-08-09 13:52 - 00000000 ____D () C:\Users\***\AppData\Local\Downloaded Installations
2014-10-14 18:50 - 2012-11-21 17:57 - 00754172 _____ () C:\WINDOWS\system32\perfh007.dat
2014-10-14 18:50 - 2012-11-21 17:57 - 00156362 _____ () C:\WINDOWS\system32\perfc007.dat
2014-10-14 18:50 - 2012-07-26 08:28 - 01748838 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-10-14 00:13 - 2014-03-25 14:28 - 00001610 _____ () C:\WINDOWS\Sandboxie.ini
2014-10-13 23:46 - 2013-08-10 14:28 - 00000000 ____D () C:\Users\***\AppData\Roaming\RenPy
2014-10-13 23:42 - 2012-07-26 06:26 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-10-13 00:58 - 2014-04-12 16:42 - 00000000 ____D () C:\Users\***\AppData\Roaming\vlc
2014-10-13 00:39 - 2013-08-28 15:47 - 00000000 ____D () C:\Users\***\AppData\Roaming\Skype
2014-10-12 19:07 - 2014-07-26 16:19 - 00025090 _____ () C:\Users\***\Desktop\Japanisch Material.odt
2014-10-12 19:07 - 2013-08-09 13:19 - 02086912 ___SH () C:\Users\***\Desktop\Thumbs.db
2014-10-12 17:22 - 2013-08-09 12:10 - 00000000 ____D () C:\Users\***\AppData\Local\Packages
2014-10-11 23:26 - 2013-08-14 19:49 - 00000000 ____D () C:\ProgramData\Origin
2014-10-11 22:13 - 2013-08-14 19:43 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-10-11 19:38 - 2014-08-26 16:24 - 00000000 ____D () C:\Users\***\Documents\Calibre-Bibliothek
2014-10-11 11:48 - 2013-08-15 02:11 - 00000000 ____D () C:\Fraps
2014-10-11 10:42 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-10-09 19:22 - 2013-08-10 14:11 - 00864032 _____ () C:\WINDOWS\DirectX.log
2014-10-09 18:48 - 2013-08-14 19:43 - 00000000 ____D () C:\ProgramData\Electronic Arts
2014-10-09 18:24 - 2011-08-08 18:09 - 00000000 ____D () C:\Users\***\Documents\BioWare
2014-10-08 22:56 - 2013-08-14 19:54 - 00000000 ____D () C:\Program Files\Origin Games
2014-10-05 23:38 - 2013-08-25 11:10 - 00000000 ____D () C:\WINDOWS\Minidump
2014-10-05 23:37 - 2013-08-25 11:10 - 1786039247 _____ () C:\WINDOWS\MEMORY.DMP
2014-10-05 15:01 - 2013-12-13 22:50 - 00000000 ____D () C:\GOG Games
2014-10-05 15:01 - 2010-11-05 13:03 - 00000000 ____D () C:\Users\***\Documents\My Games
2014-10-03 16:51 - 2014-07-23 22:21 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-03 16:29 - 2013-12-13 17:41 - 00000000 ____D () C:\Users\***\AppData\Local\GOG.com
2014-10-01 21:22 - 2013-03-13 20:11 - 00021246 _____ () C:\Users\***\Documents\Vokabel Pulkina.odt
2014-09-29 19:02 - 2013-08-09 12:11 - 00000000 ____D () C:\Users\***\AppData\Roaming\Adobe
2014-09-29 17:49 - 2012-11-21 09:11 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-29 17:43 - 2012-11-21 09:10 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-09-29 17:42 - 2012-07-26 08:21 - 00042125 _____ () C:\WINDOWS\setupact.log
2014-09-29 14:11 - 2013-08-09 13:41 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-29 13:51 - 2014-08-24 18:24 - 00000000 ____D () C:\Users\***\AppData\Local\Depression Quest
2014-09-27 13:50 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\AUInstallAgent
2014-09-27 00:03 - 2011-10-05 17:20 - 00000000 ____D () C:\Users\***\Documents\My Publications
2014-09-26 19:55 - 2010-04-26 16:04 - 00000000 ____D () C:\Users\***\Documents\Literatur
2014-09-26 10:50 - 2013-08-09 12:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-25 10:04 - 2014-04-14 11:42 - 00002186 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-24 15:44 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\rescache
2014-09-24 10:53 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-09-23 10:18 - 2014-01-30 21:42 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-09-22 07:42 - 2014-09-12 15:37 - 00278152 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-09-21 18:34 - 2014-03-18 00:01 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-21 18:34 - 2013-08-27 20:32 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-21 18:34 - 2013-08-27 20:32 - 00000000 ____D () C:\ProgramData\Skype
2014-09-17 15:02 - 2013-08-21 23:05 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-17 03:13 - 2014-07-29 14:56 - 01291280 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspbridge.dll
2014-09-17 03:13 - 2013-12-07 20:47 - 02193560 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2014-09-17 03:12 - 2014-07-29 14:56 - 01715224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspbridge64.dll
2014-09-17 03:12 - 2013-12-07 20:47 - 02799784 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2014-09-17 00:02 - 2013-08-15 03:11 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-09-16 16:18 - 2012-10-03 15:51 - 00000000 ____D () C:\Users\***\Documents\Universität Innsbruck
2014-09-15 16:21 - 2013-08-09 12:10 - 00001133 _____ () C:\Users\***\Desktop\Cyberlink Power2Go.lnk
2014-09-15 14:22 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\WinStore
2014-09-15 14:22 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\SysWOW64\migwiz
2014-09-15 14:22 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Windows Photo Viewer
2014-09-15 14:22 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Windows Defender
2014-09-15 14:22 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer
2014-09-15 14:22 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-09-15 14:22 - 2012-07-26 08:52 - 00000000 ____D () C:\Program Files\Windows Journal
2014-09-15 14:22 - 2012-07-26 08:51 - 00000000 ____D () C:\WINDOWS\SysWOW64\winrm
2014-09-15 14:22 - 2012-07-26 08:51 - 00000000 ____D () C:\WINDOWS\SysWOW64\sysprep
2014-09-15 14:22 - 2012-07-26 08:51 - 00000000 ____D () C:\WINDOWS\SysWOW64\slmgr
2014-09-15 14:22 - 2012-07-26 06:38 - 00000000 ____D () C:\WINDOWS\SysWOW64\oobe
2014-09-15 14:21 - 2012-11-21 17:56 - 00000000 ____D () C:\sources
2014-09-15 14:21 - 2012-07-26 09:12 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2014-09-15 14:21 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\SysWOW64\MUI
2014-09-15 14:21 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\SysWOW64\Com
2014-09-15 14:21 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\SystemResetPlatform
2014-09-15 14:21 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\MUI
2014-09-15 14:21 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\migwiz
2014-09-15 14:21 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\Com
2014-09-15 14:21 - 2012-07-26 08:51 - 00000000 ____D () C:\WINDOWS\SysWOW64\WCN
2014-09-15 14:21 - 2012-07-26 08:51 - 00000000 ____D () C:\WINDOWS\SysWOW64\Printing_Admin_Scripts
2014-09-15 14:21 - 2012-07-26 08:51 - 00000000 ____D () C:\WINDOWS\system32\winrm
2014-09-15 14:21 - 2012-07-26 08:51 - 00000000 ____D () C:\WINDOWS\system32\WCN
2014-09-15 14:21 - 2012-07-26 08:51 - 00000000 ____D () C:\WINDOWS\system32\slmgr
2014-09-15 14:21 - 2012-07-26 08:51 - 00000000 ____D () C:\WINDOWS\system32\Printing_Admin_Scripts
2014-09-15 14:21 - 2012-07-26 06:38 - 00000000 ____D () C:\WINDOWS\SysWOW64\Dism
2014-09-15 14:21 - 2012-07-26 06:38 - 00000000 ____D () C:\WINDOWS\system32\Sysprep
2014-09-15 14:21 - 2012-07-26 06:38 - 00000000 ____D () C:\WINDOWS\system32\oobe
2014-09-15 14:21 - 2012-07-26 06:38 - 00000000 ____D () C:\WINDOWS\system32\Dism
2014-09-14 13:14 - 2013-08-09 13:53 - 00000000 ____D () C:\Users\***\AppData\Roaming\Samsung
2014-09-14 13:08 - 2013-12-20 02:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2014-09-14 13:08 - 2012-11-21 09:16 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-14 13:07 - 2013-08-09 13:52 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-09-14 01:11 - 2013-10-12 17:27 - 00000000 ____D () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-09-14 00:48 - 2014-03-16 23:47 - 18106152 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvwgf2um.dll
2014-09-14 00:48 - 2013-11-20 18:24 - 16875856 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvd3dum.dll
2014-09-14 00:48 - 2012-11-21 09:10 - 03223120 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2014-09-14 00:48 - 2012-11-21 09:10 - 02838424 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2014-09-14 00:48 - 2012-11-21 09:10 - 00984424 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvumdshimx.dll
2014-09-14 00:48 - 2012-11-21 09:10 - 00867528 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvumdshim.dll
2014-09-14 00:48 - 2012-11-21 09:10 - 00174856 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvinitx.dll
2014-09-14 00:48 - 2012-11-21 09:10 - 00156840 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvinit.dll
2014-09-14 00:48 - 2012-11-21 09:10 - 00026956 _____ () C:\WINDOWS\system32\nvinfo.pb

Some content of TEMP:
====================
C:\Users\***\AppData\Local\Temp\avgnt.exe
C:\Users\***\AppData\Local\Temp\cabex.dll
C:\Users\***\AppData\Local\Temp\OptimizerPro.exe
C:\Users\***\AppData\Local\Temp\Quarantine.exe
C:\Users\***\AppData\Local\Temp\SandboxieInstall.exe
C:\Users\***\AppData\Local\Temp\sfamcc00001.dll
C:\Users\***\AppData\Local\Temp\SkypeSetup.exe
C:\Users\***\AppData\Local\Temp\sqlite3.dll
C:\Users\***\AppData\Local\Temp\tu17p84.exe
C:\Users\***\AppData\Local\Temp\unelevate.exe
C:\Users\***\AppData\Local\Temp\vcredist_x64.exe
C:\Users\***\AppData\Local\Temp\VirtualRouterPlusSetup.exe
C:\Users\***\AppData\Local\Temp\ytaiesmt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-13 12:03

==================== End Of Log ============================
         

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-10-2014 02
Ran by *** at 2014-10-14 20:55:26
Running from C:\Users\***\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
A1 Dashboard (HKLM-x32\...\TAG) (Version: 2.0.4 - A1 Telekom Austria AG)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version:  - Amazon)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.7 - Atheros Communications Inc.)
Benutzerhandbuch (x32 Version: 1.0.0.9 - Lenovo) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broken Age -  Act 1 (HKLM-x32\...\GOGPACKBROKENAGEACT1_is1) (Version: 2.0.0.1 - GOG.com)
calibre (HKLM-x32\...\{E25A469A-2E07-40F5-8B9E-C13B1358A431}) (Version: 1.16.0 - Kovid Goyal)
Crusader Kings II (HKLM-x32\...\Steam App 203770) (Version:  - Paradox Development Studio)
CrystalDiskInfo 5.0.0 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 5.0.0 - Crystal Dew World)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0015-0000-0000-0000000FF1CE}_Office14.AccessR_{650DE870-ECA3-4E63-8D77-778512BE5D4C}) (Version:  - Microsoft)
Depression Quest (HKLM-x32\...\Steam App 270170) (Version:  - The Quinnspiracy)
Desura (HKLM-x32\...\Desura) (Version:  - Desura)
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.16 - Dolby Laboratories Inc)
Dragon Age: Origins (HKLM-x32\...\{AEC81925-9C76-4707-84A9-40696C613ED3}) (Version: 1.05.0.0 - Electronic Arts)
Dual-Core Optimizer (HKLM-x32\...\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}) (Version: 1.1.4.0169 - AMD)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 8.0.2.4 - Lenovo)
Energy Management (x32 Version: 8.0.2.4 - Lenovo) Hidden
ExpressCache (HKLM\...\{2EBEFDA8-F905-4C39-AC1C-D5ABE7B3E0AE}) (Version: 1.0.86 - Diskeeper Corporation)
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version:  - Obsidian Entertainment)
Fotogalerie (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Gargoyle (HKLM-x32\...\Gargoyle) (Version:  - )
GOG.com Downloader version 3.6.0 (HKLM-x32\...\{456A5815-604D-4D72-94DF-346D2B978A59}_is1) (Version: 3.6.0 - GOG.com)
Gone Home (HKLM-x32\...\Steam App 232430) (Version:  - The Fullbright Company)
Goodbye Deponia (HKLM-x32\...\GOGPACKGOODBYEDEPONIA_is1) (Version: 2.0.1.9 - GOG.com)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.124 - Google Inc.)
GSmartControl (HKLM-x32\...\GSmartControl) (Version: 0.8.6 - Alexander Shaduri)
Ikaruga (HKLM-x32\...\Steam App 253750) (Version:  - Treasure)
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33057) (Version: 3.6.1.33057.10 - Intel)
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.4.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) WiDi (HKLM\...\{EDBA2433-0910-4C72-8C5B-8FEDAE3EF18E}) (Version: 3.5.34.0 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{89D2FA50-6002-4AFB-8586-3E38B355E891}) (Version: 15.05.2000.1462 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Intelligent Touchpad (HKLM-x32\...\{DD7D6D84-93AB-48CA-A759-94324E341CBA}) (Version: 2.00.0012.0723 - Lenovo)
iTunes (HKLM\...\{37D0157F-45C6-4DB2-9AE5-489DD98CE169}) (Version: 11.1.2.31 - Apple Inc.)
Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.71.1 - JMicron Technology Corp.)
Katawa Shoujo (HKLM-x32\...\Katawa Shoujo) (Version:  - )
Kentucky Route Zero (HKLM-x32\...\Steam App 231200) (Version:  - Cardboard Computer)
Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.2200 - Broadcom Corporation)
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ECC-B6BD-9C31E51D0333}) (Version: 1.12.824.1 - Vimicro)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.0828 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.0828 - CyberLink Corp.) Hidden
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4331.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.4331.52 - CyberLink Corp.) Hidden
Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.1.3127 - CyberLink Corp.)
Lenovo YouCam (x32 Version: 4.1.3127 - CyberLink Corp.) Hidden
MakeMKV v1.8.13 (HKLM-x32\...\MakeMKV) (Version: v1.8.13 - GuinpinSoft inc)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Access 2010 (HKLM-x32\...\Office14.AccessR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft IntelliPoint 8.2 (Version: 8.20.468.0 - Microsoft Corporation) Hidden
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4649.1003 - Microsoft Corporation)
Microsoft Office Access 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.0.4024.1220 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{307a22b8-8353-4c5e-b67b-2404c5734558}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Mobipocket Creator 4.2 (HKLM-x32\...\{AFE499B5-FCC4-45E6-A1A5-3C51AE0E539B}) (Version: 4.2.41 - Mobipocket.com)
MotioninJoy Gamepad tool 0.7.0000 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.0000 - www.motioninjoy.com)
Movie Maker (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
NVIDIA GeForce Experience 2.1.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.2 - NVIDIA Corporation)
NVIDIA GeForce Experience Service (Version: 16.13.42 - NVIDIA Corporation) Hidden
NVIDIA Grafiktreiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.162.1274 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 2.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus Update 16.13.42 (Version: 16.13.42 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.14.0702 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
NVIDIA ShadowPlay 16.13.42 (Version: 16.13.42 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 344.11 (Version: 344.11 - NVIDIA Corporation) Hidden
NVIDIA Update 16.13.42 (Version: 16.13.42 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 16.13.42 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.25 (Version: 1.2.25 - NVIDIA Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4649.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4649.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4649.1003 - Microsoft Corporation) Hidden
Onekey Theater (HKLM-x32\...\{91CC5BAE-A098-40D3-A43B-C0DC7CE263FE}) (Version: 3.0.0.9 - Lenovo)
OpenOffice 4.0.0 (HKLM-x32\...\{B28DBCBA-60F8-40ED-B35B-F510C327946C}) (Version: 4.00.9702 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 8.6.0.357 - Electronic Arts, Inc.)
PCSX2 - Playstation 2 Emulator (HKLM-x32\...\pcsx2-r5875) (Version:  - )
Photo Gallery (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.9109 - CyberLink Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6680 - Realtek Semiconductor Corp.)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.0.6 - Rockstar Games)
Sam & Max 304: Beyond the Alley of the Dolls (HKLM-x32\...\Steam App 31250) (Version:  - Telltale Games)
Samsung AllShare (HKLM-x32\...\InstallShield_{DF47ACA3-7C78-4C08-8007-AC682563C9F1}) (Version: 2.1.0.11123_8 - Samsung Electronics Co., Ltd.)
Samsung AllShare (x32 Version: 2.1.0.11123_8 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.14044_17 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.3.14044_17 - Samsung Electronics Co., Ltd.) Hidden
Sandboxie 4.12 (64-bit) (HKLM\...\Sandboxie) (Version: 4.12 - Sandboxie Holdings, LLC)
Secunia PSI (3.0.0.7011) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.7011 - Secunia)
Secure Banking Version 1.5.1 (HKLM-x32\...\{207E9B74-F4D3-4FD7-8142-16FF41825BC4}_is1) (Version: 1.5.1 - Hopfgartner Niklas)
SEGA Genesis & Mega Drive Classics (HKLM-x32\...\Steam App 34270) (Version:  - Sega)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0015-0000-0000-0000000FF1CE}_Office14.AccessR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
SHIELD Streaming (Version: 3.1.200 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.13.42 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spelunky (HKLM-x32\...\Steam App 239350) (Version:  - )
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
SugarSync Manager (HKLM-x32\...\SugarSync) (Version: 1.9.61.90905 - SugarSync, Inc.)
Super Meat Boy (HKLM-x32\...\Steam App 40800) (Version:  - Team Meat)
Superbrothers: Sword & Sworcery EP (HKLM-x32\...\Steam App 204060) (Version:  - Capybara)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.13 - Synaptics Incorporated)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version: 4.5.2f1 - Unity Technologies ApS)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0015-0000-0000-0000000FF1CE}_Office14.AccessR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.AccessR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0015-0000-0000-0000000FF1CE}_Office14.AccessR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.AccessR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0015-0000-0000-0000000FF1CE}_Office14.AccessR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0015-0000-0000-0000000FF1CE}_Office14.AccessR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0015-0000-0000-0000000FF1CE}_Office14.AccessR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2687502) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.AccessR_{7DE7DF97-82FE-4B3A-AB8D-1621F9CC464A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.AccessR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0015-0000-0000-0000000FF1CE}_Office14.AccessR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{91140000-0015-0000-0000-0000000FF1CE}_Office14.AccessR_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0015-0000-0000-0000000FF1CE}_Office14.AccessR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...\{91140000-0015-0000-0000-0000000FF1CE}_Office14.AccessR_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...\{91140000-0015-0000-0000-0000000FF1CE}_Office14.AccessR_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.AccessR_{EAD7BEF9-B28C-425F-B2C5-538CB27EF013}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.AccessR_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.AccessR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.AccessR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.9 - Lenovo)
VLC media player 2.0.8 (HKLM\...\VLC media player) (Version: 2.0.8 - VideoLAN)
Windows 7 Upgrade Advisor (HKLM-x32\...\{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}) (Version: 2.0.5000.0 - Microsoft Corporation)
Windows Live Communications Platform (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3522.0110 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (06/15/2012 8.1.0.1) (HKLM\...\71BC3FD63F450BA0A957AAECBDB4A000C4F2BE42) (Version: 06/15/2012 8.1.0.1 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid  (06/19/2012 10.13.29.733) (HKLM\...\8A223E56FB1ED4F697B54E5BF96F1EB63B512684) (Version: 06/19/2012 10.13.29.733 - Lenovo)
WinPatrol (HKLM\...\{A62F9CD0-B2E0-4F2A-88F2-79254A3C8539}) (Version: 25.0.2012.5 - BillP Studios)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1429691773-2651506096-3644874853-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\***\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1429691773-2651506096-3644874853-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\***\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1429691773-2651506096-3644874853-1002_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\***\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1429691773-2651506096-3644874853-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\***\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1429691773-2651506096-3644874853-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\***\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

06-10-2014 00:28:27 Removed Virtual Router v1.0
09-10-2014 17:22:10 DirectX wurde installiert
14-10-2014 18:00:40 Installed Virtual Router v1.0

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {05CCB2CB-3976-48EB-9C1E-79D7E444DFD7} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2B2136A3-76CA-4FBC-AD49-0E43CBAE6744} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-14] (Google Inc.)
Task: {37E557DF-203C-47C7-8DF4-8ADFA395358E} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-09] (Adobe Systems Incorporated)
Task: {5E247365-26F7-43F4-848F-2C975C84F227} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-08-12] (Microsoft Corporation)
Task: {6F671D14-F385-4773-AFAE-BB37A04AF1B7} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-09-12] (Microsoft Corporation)
Task: {784278B2-DD74-4923-95DB-C767319F5B6C} - System32\Tasks\UACO => C:\Users\***\AppData\Roaming\UACO.exe <==== ATTENTION
Task: {7D72AFF6-8DE6-46F6-A555-E0260E17DA9D} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\WINDOWS\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {852F859E-FF59-4BEF-AF50-58E4DB841C97} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-14] (Google Inc.)
Task: {8C9C3866-B265-4436-87D0-AC8A2EB0A6CA} - System32\Tasks\CLQHUO => C:\Users\***\AppData\Roaming\CLQHUO.exe <==== ATTENTION
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {BCE26D71-B854-4CE5-97C9-AF0A746B384A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {FC4AE336-D827-47C5-B77D-A598E29F05F6} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-09-23] (Microsoft Corporation)
Task: {FFBE107B-37D8-4ABF-9400-4939FC76ECD5} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2012-07-27] (CyberLink)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\CLQHUO.job => C:\Users\***\AppData\Roaming\CLQHUO.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\UACO.job => C:\Users\***\AppData\Roaming\UACO.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2012-11-21 09:10 - 2014-09-14 00:48 - 00013120 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2012-11-21 09:11 - 2014-09-13 22:53 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-09-06 15:53 - 2012-09-06 15:53 - 00047480 _____ () C:\Program Files\Lenovo\Bluetooth Software\BtwLeAPI.dll
2014-03-19 02:18 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-10-12 15:46 - 2013-07-03 09:32 - 00510520 _____ () C:\Program Files (x86)\A1 Dashboard\A1Dashboard_Service.exe
2012-11-21 09:22 - 2012-09-14 03:55 - 00051776 _____ () C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
2012-08-31 06:54 - 2012-08-24 00:07 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-10-12 15:46 - 2013-07-03 09:32 - 00531000 _____ () C:\Program Files (x86)\A1 Dashboard\A1Dashboard_Launcher.exe
2013-04-21 20:44 - 2013-04-21 20:44 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-04-21 20:44 - 2013-04-21 20:44 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-09-13 09:40 - 2014-09-13 09:40 - 00017920 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\0bfee455e1830581b26b9e587a9dfb85\PSIClient.ni.dll
2014-09-25 10:14 - 2014-09-25 10:14 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-10-24 01:56 - 2014-09-14 00:48 - 00012104 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2014-09-13 10:47 - 2012-06-20 22:23 - 00599419 ____N () C:\Program Files (x86)\BillP Studios\WinPatrol\sqlite3.dll
2013-10-12 15:46 - 2013-07-03 09:31 - 00257024 _____ () C:\Program Files (x86)\A1 Dashboard\WtgMobileBroadband7.dll
2013-10-12 15:46 - 2012-01-25 10:38 - 01097728 _____ () C:\Program Files (x86)\A1 Dashboard\NDISAPI.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 01117184 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMSWrap.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00649728 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ContentDirectoryPresenter.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00105472 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\DCMCDP.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00098816 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\FolderCDP.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00031232 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\Autobackup.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00054784 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\RosettaAllShare.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00077312 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\MetadataFramework.dll
2011-09-02 14:14 - 2011-09-02 14:14 - 00520234 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\sqlite3.dll
2011-09-02 14:14 - 2011-09-02 14:14 - 00450560 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\MoodExtractor.dll
2011-09-02 14:14 - 2011-09-02 14:14 - 05717504 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\DCMImgExtractor.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00029184 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AutoChaptering.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00027648 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AudioExtractor.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00017920 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoExtractor.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00012288 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ImageExtractor.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00013824 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\TextExtractor.dll
2011-09-02 14:14 - 2011-09-02 14:14 - 00147456 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libexpat.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00012288 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoThumb.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00063488 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ID3Driver.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00023040 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\RichInfoDriver.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00017920 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ThumbnailMaker.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00133120 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoMetadataDriver.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00024064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\SECMetaDriver.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00024064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\photoDriver.dll
2011-09-02 14:14 - 2011-09-02 14:14 - 04671488 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avcodec-52.dll
2011-09-02 14:14 - 2011-09-02 14:14 - 00686080 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avformat-52.dll
2011-09-02 14:14 - 2011-09-02 14:14 - 00070656 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avutil-50.dll
2011-09-02 14:14 - 2011-09-02 14:14 - 00152064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\swscale-0.dll
2011-09-02 14:14 - 2011-09-02 14:14 - 00366592 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\tag.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00289792 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libThumbnail.dll
2011-11-29 17:39 - 2011-11-29 17:39 - 00290304 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libKeyFrame.dll
2011-09-02 14:14 - 2011-09-02 14:14 - 00399826 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libexif-12.dll.dll
2011-09-02 14:14 - 2011-09-02 14:14 - 00044032 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\us.dll
2012-11-21 09:17 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:56E2E879
AlternateDataStreams: C:\ProgramData\Temp:5C321E34

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "AllShareAgent"
HKLM\...\StartupApproved\Run32: => "ApnTBMon"
HKCU\...\StartupApproved\Run: => "SecureBanking"
HKCU\...\StartupApproved\Run: => "Steam"

========================= Accounts: ==========================

Administrator (S-1-5-21-1429691773-2651506096-3644874853-500 - Administrator - Disabled)
Gast (S-1-5-21-1429691773-2651506096-3644874853-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1429691773-2651506096-3644874853-1004 - Limited - Enabled)
*** (S-1-5-21-1429691773-2651506096-3644874853-1002 - Administrator - Enabled) => C:\Users\***

==================== Faulty Device Manager Devices =============

Name: USB-IF xHCI USB Host Controller
Description: USB-IF xHCI USB Host Controller
Class Guid: {8a2edc79-c759-46f2-88af-9d4efe3b5eee}
Manufacturer: Intel Corporation
Service: XHCIPort
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Lenovo EasyCamera
Description: Lenovo EasyCamera
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Vimicro
Service: vm332avs
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/14/2014 07:37:05 PM) (Source: MsiInstaller) (EventID: 11309) (User: idea-PC)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt.  System error 3.  Verify that the file exists and that you can access it.

Error: (10/14/2014 07:35:33 PM) (Source: MsiInstaller) (EventID: 11309) (User: idea-PC)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt.  System error 3.  Verify that the file exists and that you can access it.

Error: (10/14/2014 07:23:52 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: idea-PC)
Description: Die Anwendung oder der Dienst "VirtualRouterService" konnte nicht neu gestartet werden.

Error: (10/14/2014 07:23:44 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: idea-PC)
Description: Die Anwendung oder der Dienst "VirtualRouterService" konnte nicht heruntergefahren werden.

Error: (10/14/2014 07:13:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: spbia.exe, Version: 1.0.0.4, Zeitstempel: 0x543d5873
Name des fehlerhaften Moduls: spbia.exe, Version: 1.0.0.4, Zeitstempel: 0x543d5873
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000000a746
ID des fehlerhaften Prozesses: 0x205c
Startzeit der fehlerhaften Anwendung: 0xspbia.exe0
Pfad der fehlerhaften Anwendung: spbia.exe1
Pfad des fehlerhaften Moduls: spbia.exe2
Berichtskennung: spbia.exe3
Vollständiger Name des fehlerhaften Pakets: spbia.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: spbia.exe5

Error: (10/14/2014 07:10:23 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm biclient.exe, Version 1.0.0.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: bd4

Startzeit: 01cfe7d9d45fa7fd

Endzeit: 4294967295

Anwendungspfad: C:\Users\***\Downloads\nw_29531_virtualrouterplusset\$TEMP\biclient.exe

Berichts-ID: 5d0296c9-53cd-11e4-bfa4-e006e6bf8c1d

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (10/14/2014 06:54:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname idea-PC.local already in use; will try idea-PC-2.local instead

Error: (10/14/2014 06:54:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 2; will deregister    4 idea-PC.local. Addr 10.5.8.183

Error: (10/14/2014 06:54:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 10.5.0.135:5353    4 idea-PC.local. Addr 10.5.0.135

Error: (10/14/2014 06:52:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname idea-PC.local already in use; will try idea-PC-2.local instead


System errors:
=============
Error: (10/14/2014 07:12:55 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "YouTubeAcceleratorService" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (10/14/2014 06:55:05 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%2147952449

Error: (10/14/2014 06:55:05 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%2147952449

Error: (10/14/2014 06:55:04 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%2147952449

Error: (10/14/2014 06:55:04 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%2147952449

Error: (10/14/2014 06:52:29 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%2147952449

Error: (10/14/2014 06:52:29 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%2147952449

Error: (10/14/2014 06:52:28 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%2147952449

Error: (10/14/2014 06:52:28 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%2147952449

Error: (10/14/2014 06:46:30 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%2147952449


Microsoft Office Sessions:
=========================
Error: (10/14/2014 07:37:05 PM) (Source: MsiInstaller) (EventID: 11309) (User: idea-PC)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt.  System error 3.  Verify that the file exists and that you can access it.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (10/14/2014 07:35:33 PM) (Source: MsiInstaller) (EventID: 11309) (User: idea-PC)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt.  System error 3.  Verify that the file exists and that you can access it.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (10/14/2014 07:23:52 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: idea-PC)
Description: 0VirtualRouterService.exeVirtualRouterService03026217883560

Error: (10/14/2014 07:23:44 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: idea-PC)
Description: 0VirtualRouterService.exeVirtualRouterService0302621618356543003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C005600690072007400750061006C00200052006F0075007400650072005C0049006E007400650072006F0070002E004E004500540043004F004E004C00690062002E0064006C006C00000043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C005600690072007400750061006C00200052006F0075007400650072005C005600690072007400750061006C0052006F0075007400650072002E004900430053002E0064006C006C00000043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C005600690072007400750061006C00200052006F0075007400650072005C005600690072007400750061006C0052006F00750074006500720053006500720076006900630065002E00650078006500000043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C005600690072007400750061006C00200052006F0075007400650072005C005600690072007400750061006C0052006F0075007400650072002E0057006C0061006E002E0064006C006C00000043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C005600690072007400750061006C00200052006F0075007400650072005C005600690072007400750061006C0052006F00750074006500720048006F00730074002E0064006C006C000000

Error: (10/14/2014 07:13:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: spbia.exe1.0.0.4543d5873spbia.exe1.0.0.4543d5873c0000005000000000000a746205c01cfe7da71e0235eC:\Program Files\Common Files\ShopperPro\spbia.exeC:\Program Files\Common Files\ShopperPro\spbia.exed37a12f9-53cd-11e4-bfa4-e006e6bf8c1d

Error: (10/14/2014 07:10:23 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: biclient.exe1.0.0.1bd401cfe7d9d45fa7fd4294967295C:\Users\***\Downloads\nw_29531_virtualrouterplusset\$TEMP\biclient.exe5d0296c9-53cd-11e4-bfa4-e006e6bf8c1d

Error: (10/14/2014 06:54:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname idea-PC.local already in use; will try idea-PC-2.local instead

Error: (10/14/2014 06:54:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 2; will deregister    4 idea-PC.local. Addr 10.5.8.183

Error: (10/14/2014 06:54:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 10.5.0.135:5353    4 idea-PC.local. Addr 10.5.0.135

Error: (10/14/2014 06:52:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname idea-PC.local already in use; will try idea-PC-2.local instead


CodeIntegrity Errors:
===================================
  Date: 2014-10-13 00:38:22.152
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume7\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-12 13:16:37.564
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume7\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-11 20:13:57.573
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume7\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-11 17:36:04.320
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume7\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-11 17:32:29.029
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume7\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-11 17:30:17.032
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume7\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-11 17:29:18.949
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume7\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-10 16:53:18.273
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume7\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-09-29 22:38:21.925
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume7\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-09-21 18:39:16.351
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume7\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-3630QM CPU @ 2.40GHz
Percentage of memory in use: 38%
Total physical RAM: 8057.77 MB
Available physical RAM: 4940.99 MB
Total Pagefile: 16249.77 MB
Available Pagefile: 12993.97 MB
Total Virtual: 8192 MB
Available Virtual: 8191.77 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:884.18 GB) (Free:526.04 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:21.98 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 14.9 GB) (Disk ID: CBC6C28A)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: CBC6C287)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

Vielen Dank im Voraus,
paramo

hi,

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

2014-10-14 19:37 - 2014-10-14 20:24 - 00001370 _____ () C:\WINDOWS\Tasks\CLQHUO.job
2014-10-14 19:37 - 2014-10-14 19:37 - 00004384 _____ () C:\WINDOWS\System32\Tasks\CLQHUO
2014-10-14 19:34 - 2014-10-14 20:24 - 00001366 _____ () C:\WINDOWS\Tasks\UACO.job
2014-10-14 19:34 - 2014-10-14 19:34 - 00004378 _____ () C:\WINDOWS\System32\Tasks\UACO
Task: {784278B2-DD74-4923-95DB-C767319F5B6C} - System32\Tasks\UACO => C:\Users\***\AppData\Roaming\UACO.exe <==== ATTENTION

Task: {8C9C3866-B265-4436-87D0-AC8A2EB0A6CA} - System32\Tasks\CLQHUO => C:\Users\***\AppData\Roaming\CLQHUO.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\CLQHUO.job => C:\Users\***\AppData\Roaming\CLQHUO.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\UACO.job => C:\Users\***\AppData\Roaming\UACO.exe <==== ATTENTION
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Hi,

vielen Dank für deine schnelle Hilfe und sorry wegen der späten Antwort. Hier sind die Logs:

Fixlog

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-10-2014 02
Ran by *** at 2014-10-15 13:00:46 Run:1
Running from C:\Users\***\Desktop
Loaded Profile: *** (Available profiles: ***)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
2014-10-14 19:37 - 2014-10-14 20:24 - 00001370 _____ () C:\WINDOWS\Tasks\CLQHUO.job
2014-10-14 19:37 - 2014-10-14 19:37 - 00004384 _____ () C:\WINDOWS\System32\Tasks\CLQHUO
2014-10-14 19:34 - 2014-10-14 20:24 - 00001366 _____ () C:\WINDOWS\Tasks\UACO.job
2014-10-14 19:34 - 2014-10-14 19:34 - 00004378 _____ () C:\WINDOWS\System32\Tasks\UACO
Task: {784278B2-DD74-4923-95DB-C767319F5B6C} - System32\Tasks\UACO => C:\Users\***\AppData\Roaming\UACO.exe <==== ATTENTION

Task: {8C9C3866-B265-4436-87D0-AC8A2EB0A6CA} - System32\Tasks\CLQHUO => C:\Users\***\AppData\Roaming\CLQHUO.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\CLQHUO.job => C:\Users\***\AppData\Roaming\CLQHUO.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\UACO.job => C:\Users\***\AppData\Roaming\UACO.exe <==== ATTENTION
*****************

C:\WINDOWS\Tasks\CLQHUO.job => Moved successfully.
C:\WINDOWS\System32\Tasks\CLQHUO => Moved successfully.
C:\WINDOWS\Tasks\UACO.job => Moved successfully.
C:\WINDOWS\System32\Tasks\UACO => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{784278B2-DD74-4923-95DB-C767319F5B6C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{784278B2-DD74-4923-95DB-C767319F5B6C}" => Key deleted successfully.
C:\Windows\System32\Tasks\UACO not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UACO" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{8C9C3866-B265-4436-87D0-AC8A2EB0A6CA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8C9C3866-B265-4436-87D0-AC8A2EB0A6CA}" => Key deleted successfully.
C:\Windows\System32\Tasks\CLQHUO not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\CLQHUO" => Key deleted successfully.
C:\WINDOWS\Tasks\CLQHUO.job not found.
C:\WINDOWS\Tasks\UACO.job not found.

==== End of Fixlog ====
         

Eset-Scan

C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\3dabfa42-13fd-4c48-8a68-743d135d1d2f-2.exe.vir	Variante von Win32/Toolbar.CrossRider.AY evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\3dabfa42-13fd-4c48-8a68-743d135d1d2f-5.exe.vir	Variante von Win32/Toolbar.CrossRider.AY evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\iWebar-bg.exe.vir	Variante von Win32/Toolbar.CrossRider.BA evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\iWebar-bho64.dll.vir	Variante von Win64/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\iWebar-codedownloader.exe.vir	Variante von Win32/Toolbar.CrossRider.AY evtl. unerwünschte Anwendung
C:\Users\***\AppData\Local\Installer\Installiwebar_14341\delay.exe	Variante von Win32/SpeedBit.C evtl. unerwünschte Anwendung
C:\Users\***\AppData\Local\Installer\Installsense_14341\delay.exe	Variante von Win32/SpeedBit.C evtl. unerwünschte Anwendung
C:\Users\***\AppData\Roaming\CLQHUO	JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung
C:\Users\***\AppData\Roaming\UACO	JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung
C:\Users\***\Downloads\nw_29531_virtualrouterplusset\$TEMP\biclient.exe	Win32/Somoto.A evtl. unerwünschte Anwendung
         

SecurityCheck

 Results of screen317's Security Check version 0.99.87  
   x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 SpywareBlaster 5.0    
 Secunia PSI (3.0.0.7011)   
 Java 7 Update 71  
 Java version out of Date! 
 Adobe Flash Player 	15.0.0.152  
 Adobe Reader XI  
 Mozilla Firefox (32.0.3) 
 Google Chrome 37.0.2062.120  
 Google Chrome 37.0.2062.124  
````````Process Check: objlist.exe by Laurent````````  
 Windows Defender MSMpEng.exe 
 Windows Defender MSASCui.exe 
 WinPatrol winpatrol.exe 
 ESET ESET Online Scanner OnlineScannerApp.exe  
 Windows Defender MsMpEng.exe   
 Windows Defender MSASCui.exe   
 BillP Studios WinPatrol WinPatrol.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-10-2014
Ran by *** (administrator) on IDEA-PC on 17-10-2014 22:17:53
Running from C:\Users\***\Desktop
Loaded Profile: *** (Available profiles: ***)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
() C:\Program Files (x86)\A1 Dashboard\A1Dashboard_Service.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Lenovo) C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Vimicro) C:\Program Files (x86)\USB Camera2\VM332STI.EXE
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Microsoft) C:\Program Files (x86)\Lenovo\Intelligent Touchpad\IntelligentTouchpad.exe
(BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
() C:\Program Files (x86)\A1 Dashboard\A1Dashboard_Launcher.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(WebToGo Gmbh) C:\Program Files (x86)\A1 Dashboard\A1Dashboard.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-27] (Synaptics Incorporated)
HKLM\...\Run: [SynLenovoGestureMgr] => C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe [665400 2012-08-27] (Synaptics)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12921488 2012-09-14] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-09-14] (Realtek Semiconductor)
HKLM\...\Run: [OnekeyStudio] => C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe [4196432 2012-08-10] (Lenovo)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17080376 2012-11-21] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [191544 2012-11-21] (Lenovo(beijing) Limited)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2460488 2014-09-17] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [332BigDog] => C:\Program Files (x86)\USB Camera2\VM332STI.EXE [548864 2012-03-20] (Vimicro)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2012-07-27] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167024 2012-07-27] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [217088 2012-04-18] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
HKLM-x32\...\Run: [IntellingentTouchpad] => C:\Program Files (x86)\Lenovo\Intelligent Touchpad\IntelligentTouchpad.exe [673336 2012-07-23] (Microsoft)
HKLM-x32\...\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe [384232 2012-07-13] (BillP Studios)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [TAG_A1Dashboard_Launcher.exe] => C:\Program Files (x86)\A1 Dashboard\A1Dashboard_Launcher.exe [531000 2013-07-03] ()
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-19] (Apple Inc.)
HKLM-x32\...\Run: [TAG_A1Dashboard.exe] => C:\Program Files (x86)\A1 Dashboard\A1Dashboard.exe [4303416 2013-07-03] (WebToGo Gmbh)
HKLM-x32\...\Run: [AllShareAgent] => C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe [284560 2011-12-16] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [310064 2014-06-14] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1939136 2014-08-28] (Valve Corporation)
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [784392 2014-05-29] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\Run: [SecureBanking] => C:\Program Files (x86)\Secure Banking\SecureBanking.exe [507904 2014-06-25] (Secure Banking)
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\RunOnce: [Uninstall C:\Users\***\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\***\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64"
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\MountPoints2: {061d3b13-010c-11e3-be79-e006e6bf8c1d} - "F:\Autorun.exe" 
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\MountPoints2: {061d3c21-010c-11e3-be79-e006e6bf8c1d} - "F:\Autorun.exe" 
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\MountPoints2: {061d3d18-010c-11e3-be79-e006e6bf8c1d} - "F:\Autorun.exe" 
HKU\S-1-5-21-1429691773-2651506096-3644874853-1002\...\MountPoints2: {e2341cd7-3254-11e3-beae-e006e6bf8c1d} - "F:\Autorun.exe" 
HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
AppInit_DLLs: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [156840 2014-09-14] (NVIDIA Corporation)
AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [174856 2014-09-14] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [156840 2014-09-14] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKLM - {0F3A5A72-ACBB-42CE-AD65-46AFF64C341A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
SearchScopes: HKLM-x32 - {0F3A5A72-ACBB-42CE-AD65-46AFF64C341A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
SearchScopes: HKCU - DefaultScope {0F3A5A72-ACBB-42CE-AD65-46AFF64C341A} URL = 
SearchScopes: HKCU - {0F3A5A72-ACBB-42CE-AD65-46AFF64C341A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: No Name -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} ->  No File
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 134.226.251.200 134.226.251.100

FireFox:
========
FF ProfilePath: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default
FF Homepage: https://www.google.at/
FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3522.0110 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\***\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\searchplugins\ponseu--russisch--deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: HTTPS-Everywhere - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\Extensions\https-everywhere@eff.org [2014-10-16]
FF Extension: Advertising Cookie Opt-out - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\Extensions\optout@google.com [2013-08-09]
FF Extension: WOT - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-27]
FF Extension: Media Hint - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\Extensions\mediahint@jetpack.xpi [2014-04-09]
FF Extension: NoScript - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-08-09]
FF Extension: Adblock Plus - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\d9065xt2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-09]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
CHR HomePage: Default -> 
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\***\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.4.600\_platform_specific\win_x86\widevinecdmadapter.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\pdf.dll ()
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.670.1) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U67) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Microsoft Office 2013) - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\***\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave Flash) - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
CHR Profile: C:\Users\***\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Media Hint) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\akipcefbjlmpbcejgdaopmmidpnjlhnb [2014-04-14]
CHR Extension: (Google Docs) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-11]
CHR Extension: (Google Drive) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-11]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-03]
CHR Extension: (YouTube) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-11]
CHR Extension: (Adblock Plus) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-07-31]
CHR Extension: (Google-Suche) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-11]
CHR Extension: (ProxMate Beta) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkijfpdhghdgfjcabjelbmmoocpefnih [2014-07-28]
CHR Extension: (Stop Autoplay for Youtube™ Extended) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\nilnpbhnhmmjioijfgilcohbknkgfmpa [2014-08-03]
CHR Extension: (Google Wallet) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-11]
CHR Extension: (Google Mail) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-11]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252088 2012-08-25] (Broadcom Corporation.)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [957304 2012-09-06] (Broadcom Corporation.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2428088 2014-08-12] (Microsoft Corporation)
R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-03-30] (Diskeeper Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2014-09-17] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [7168 2012-08-16] (Intel Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-07-18] ()
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-09-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19439944 2014-09-17] (NVIDIA Corporation)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [174088 2014-05-29] (Sandboxie Holdings, LLC)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation)
R2 TAG_Service; C:\Program Files (x86)\A1 Dashboard\A1Dashboard_Service.exe [510520 2013-07-03] ()
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2699568 2012-07-18] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [165688 2012-08-25] (Broadcom Corporation.)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-03-30] (Diskeeper Corporation)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [95024 2012-03-30] (Diskeeper Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [4273192 2012-08-19] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19272 2014-09-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [185352 2014-05-29] (Sandboxie Holdings, LLC)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-27] (Synaptics Incorporated)
S3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [48096 2012-08-09] (Windows (R) Win 7 DDK provider)
S3 usbrndis6; C:\Windows\system32\DRIVERS\usb80236.sys [20992 2013-02-12] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188384 2012-08-09] (Windows (R) Win 7 DDK provider)
S3 huawei_enumerator; \SystemRoot\System32\drivers\ew_jubusenum.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2040-02-06 05:28 - 2010-09-05 10:16 - 126165556 _____ () C:\Users\***\Documents\PONS Spanisch.ipa
2014-10-17 22:17 - 2014-10-17 22:18 - 00027949 _____ () C:\Users\***\Desktop\FRST.txt
2014-10-17 22:17 - 2014-10-17 22:17 - 00000000 ____D () C:\Users\***\Desktop\FRST-OlderVersion
2014-10-17 22:15 - 2014-10-17 22:15 - 00001172 _____ () C:\Users\***\Desktop\checkup.txt
2014-10-17 22:14 - 2014-10-17 22:14 - 00854417 _____ () C:\Users\***\Desktop\SecurityCheck.exe
2014-10-17 22:13 - 2014-10-17 22:13 - 00001365 _____ () C:\Users\***\Desktop\Esetscan.txt
2014-10-17 17:15 - 2014-10-17 17:15 - 02347384 _____ (ESET) C:\Users\***\Desktop\esetsmartinstaller_deu.exe
2014-10-17 17:15 - 2014-10-17 17:15 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-10-16 20:13 - 2014-10-16 20:13 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-10-16 20:13 - 2014-10-16 20:13 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-10-16 20:13 - 2014-10-16 20:13 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-10-16 20:13 - 2014-10-16 20:13 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-10-16 20:13 - 2014-10-16 20:13 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-16 10:53 - 2014-09-29 23:49 - 00705480 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-10-16 10:53 - 2014-09-29 23:49 - 00104904 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-15 23:39 - 2014-10-10 05:47 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-10-15 23:39 - 2014-10-10 05:47 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-10-15 23:39 - 2014-10-08 05:26 - 00556544 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-10-15 23:39 - 2014-09-20 06:18 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-10-15 23:39 - 2014-09-20 06:17 - 02236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-10-15 23:39 - 2014-09-20 06:17 - 01407488 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-10-15 23:39 - 2014-09-20 06:17 - 00915968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll
2014-10-15 23:39 - 2014-09-20 06:17 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 19280896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 15399424 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 03959296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 02655232 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 00255488 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 00097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2014-10-15 23:39 - 2014-09-20 06:16 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2014-10-15 23:39 - 2014-09-20 06:15 - 01508864 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-10-15 23:39 - 2014-09-20 06:15 - 00451584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2014-10-15 23:39 - 2014-09-20 06:15 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 14368768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 13757952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 02861568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 02055168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 01762816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 01180672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2014-10-15 23:39 - 2014-09-20 04:57 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll
2014-10-15 23:39 - 2014-09-20 04:56 - 01440768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-10-15 23:39 - 2014-09-20 04:56 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2014-10-15 23:39 - 2014-09-20 04:56 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-10-15 23:39 - 2014-09-20 04:38 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-10-15 23:39 - 2014-09-20 04:33 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-10-15 23:39 - 2014-09-20 02:06 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll
2014-10-15 23:39 - 2014-09-13 06:29 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll
2014-10-15 23:39 - 2014-09-13 05:02 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll
2014-10-15 23:39 - 2014-07-12 05:41 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRUM.DLL
2014-10-15 23:39 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDYAK.DLL
2014-10-15 23:39 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDTAT.DLL
2014-10-15 23:39 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRU1.DLL
2014-10-15 23:39 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRU.DLL
2014-10-15 23:39 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDBASH.DLL
2014-10-15 23:39 - 2014-07-12 05:16 - 00008192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRUM.DLL
2014-10-15 23:39 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDYAK.DLL
2014-10-15 23:39 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDTAT.DLL
2014-10-15 23:39 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRU1.DLL
2014-10-15 23:39 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRU.DLL
2014-10-15 23:39 - 2014-07-12 05:15 - 00006144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDBASH.DLL
2014-10-15 23:39 - 2014-07-12 01:02 - 00478352 _____ () C:\WINDOWS\SysWOW64\locale.nls
2014-10-15 23:39 - 2014-07-12 01:00 - 00478352 _____ () C:\WINDOWS\system32\locale.nls
2014-10-15 23:39 - 2014-07-08 23:33 - 00181248 _____ (Microsoft Corp.) C:\WINDOWS\system32\Defrag.exe
2014-10-15 23:39 - 2014-07-08 23:32 - 01539584 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2014-10-15 23:39 - 2014-07-08 23:32 - 00340480 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll
2014-10-15 23:39 - 2014-07-08 23:30 - 01220608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2014-10-15 23:39 - 2014-07-07 06:53 - 01125376 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2014-10-15 23:39 - 2014-07-07 06:52 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2014-10-15 23:39 - 2014-07-07 06:52 - 00724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll
2014-10-15 23:39 - 2014-07-07 06:52 - 00300544 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsta.dll
2014-10-15 23:39 - 2014-07-07 06:52 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2014-10-15 23:39 - 2014-07-07 06:52 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2014-10-15 23:39 - 2014-07-07 06:51 - 05982208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-10-15 23:39 - 2014-07-07 05:01 - 01049600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2014-10-15 23:39 - 2014-07-07 05:01 - 00233472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winsta.dll
2014-10-15 23:39 - 2014-07-07 05:00 - 05095424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-10-15 23:39 - 2014-07-07 04:59 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aaclient.dll
2014-10-15 23:39 - 2014-07-04 11:52 - 00328000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2014-10-15 23:39 - 2014-07-03 02:59 - 01824784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-10-15 23:39 - 2014-07-03 01:30 - 01408952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-10-15 23:39 - 2014-06-28 08:01 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmapi.dll
2014-10-15 23:39 - 2014-06-28 07:57 - 00209920 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2014-10-15 23:39 - 2014-06-28 07:56 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmapi.dll
2014-10-15 23:39 - 2014-06-25 08:09 - 00733184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2014-10-15 23:39 - 2014-06-25 08:07 - 01023488 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2014-10-15 23:39 - 2014-06-18 00:27 - 02032640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2014-10-15 23:39 - 2014-06-18 00:23 - 02238464 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2014-10-15 23:39 - 2014-06-11 15:47 - 02842112 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVDECOD.DLL
2014-10-15 23:39 - 2014-06-11 05:40 - 02620928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVDECOD.DLL
2014-10-15 23:39 - 2014-06-10 23:44 - 01403896 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2014-10-15 23:39 - 2014-05-30 00:31 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2014-10-15 23:39 - 2014-05-30 00:03 - 00419328 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2014-10-15 23:39 - 2014-02-04 11:57 - 01271664 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2014-10-15 23:38 - 2014-09-28 05:18 - 04068352 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-10-15 23:38 - 2014-09-18 00:24 - 02416128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2014-10-15 23:38 - 2014-09-17 23:56 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2014-10-15 23:38 - 2014-09-03 03:48 - 00510464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2014-10-15 23:38 - 2014-09-03 03:21 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2014-10-15 23:38 - 2014-08-30 06:48 - 10115072 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-10-15 23:38 - 2014-08-30 06:46 - 02306560 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-10-15 23:38 - 2014-08-30 05:05 - 08858112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-10-15 23:38 - 2014-08-30 05:03 - 02037760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-10-15 23:38 - 2014-08-01 23:08 - 00388729 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2014-10-15 23:38 - 2014-07-24 14:50 - 00447296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2014-10-15 23:38 - 2014-07-17 00:28 - 00027648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sscore.dll
2014-10-15 23:38 - 2014-07-16 23:59 - 00305664 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvsvc.dll
2014-10-15 23:38 - 2014-07-16 23:59 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\sscore.dll
2014-10-15 23:38 - 2014-07-12 07:45 - 01549824 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
2014-10-15 23:38 - 2014-07-12 05:36 - 00674304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2014-10-15 23:38 - 2014-07-12 05:36 - 00211456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2014-10-15 23:38 - 2014-07-12 05:34 - 00404480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2014-10-15 23:38 - 2014-07-12 05:34 - 00250368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys
2014-10-15 23:38 - 2014-06-28 07:57 - 01341952 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2014-10-15 23:38 - 2014-06-28 03:23 - 01126400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2014-10-15 23:38 - 2014-06-13 00:34 - 00754176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2014-10-15 23:38 - 2014-06-13 00:29 - 02146304 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2014-10-14 21:46 - 2014-10-15 13:00 - 00000000 ____D () C:\Users\***\Desktop\trojanerboard
2014-10-14 20:54 - 2014-10-17 22:18 - 00000000 ____D () C:\FRST
2014-10-14 20:54 - 2014-10-14 20:54 - 00000000 _____ () C:\Users\***\defogger_reenable
2014-10-14 20:08 - 2014-10-17 22:17 - 02112000 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe
2014-10-14 20:05 - 2014-10-14 20:26 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-10-14 20:05 - 2014-10-14 20:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-14 20:05 - 2014-10-14 20:05 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-14 20:05 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-10-14 20:05 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-10-14 20:05 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-10-14 20:04 - 2014-10-14 20:04 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\***\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-14 20:00 - 2014-10-14 20:01 - 00000000 ____D () C:\AdwCleaner
2014-10-14 19:57 - 2014-10-14 19:57 - 00000000 ____D () C:\Users\***\AppData\Local\VS Revo Group
2014-10-14 19:57 - 2014-10-14 19:57 - 00000000 ____D () C:\ProgramData\VS Revo Group
2014-10-14 19:56 - 2014-10-14 19:57 - 10691640 _____ (VS Revo Group ) C:\Users\***\Downloads\RevoUninProSetup.exe
2014-10-14 19:15 - 2014-10-14 19:15 - 00000000 ____D () C:\Users\***\AppData\Local\VirtualRouterPlus
2014-10-14 19:12 - 2014-10-14 19:12 - 00000000 ____D () C:\Users\***\AppData\Local\CrashRpt
2014-10-14 19:07 - 2014-10-14 19:07 - 00000000 ____D () C:\Users\***\Downloads\nw_29531_virtualrouterplusset
2014-10-13 23:41 - 2014-10-13 23:41 - 00042152 _____ (Connectify) C:\WINDOWS\system32\Drivers\cnnctfy3.sys
2014-10-12 14:52 - 2014-10-12 14:52 - 00001122 _____ () C:\Users\***\Desktop\Katawa Shoujo.lnk
2014-10-12 14:52 - 2014-10-12 14:52 - 00000000 ____D () C:\Program Files (x86)\Katawa Shoujo
2014-10-12 14:46 - 2014-10-12 14:51 - 448764288 _____ () C:\Users\***\Downloads\[4ls]_katawa_shoujo_1.2-[windows][64ECD9F9].exe
2014-10-11 11:47 - 2014-10-11 11:47 - 00007063 _____ () C:\Users\***\Desktop\BU4511 Int. Business & Global Economy - Verknüpfung.lnk
2014-10-11 11:47 - 2014-10-11 11:47 - 00007059 _____ () C:\Users\***\Desktop\EC4100 International Economics, Trade - Verknüpfung.lnk
2014-10-11 11:47 - 2014-10-11 11:47 - 00006958 _____ () C:\Users\***\Desktop\BU3600 New Venture Development - Verknüpfung.lnk
2014-10-11 11:47 - 2014-10-11 11:47 - 00006849 _____ () C:\Users\***\Desktop\EC3030 European Economy - Verknüpfung.lnk
2014-10-11 11:47 - 2014-10-11 11:47 - 00006838 _____ () C:\Users\***\Desktop\BU3541 Applied Finance - Verknüpfung.lnk
2014-10-09 18:24 - 2014-10-09 19:22 - 00001132 _____ () C:\Users\Public\Desktop\Dragon Age Origins.lnk
2014-10-09 18:24 - 2014-10-09 18:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dragon Age Origins
2014-10-07 13:00 - 2014-10-07 13:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2014-10-05 23:38 - 2014-10-05 23:39 - 00304280 _____ () C:\WINDOWS\Minidump\100514-36468-01.dmp
2014-10-05 03:37 - 2014-10-05 03:37 - 00000000 ____D () C:\Users\***\AppData\Local\Chris_Pietschmann_(http__
2014-10-04 19:09 - 2014-10-05 23:36 - 00000518 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.ics
2014-10-04 19:03 - 2014-10-14 19:23 - 00000000 ____D () C:\Program Files (x86)\Virtual Router
2014-10-04 19:02 - 2014-10-04 19:02 - 01101648 _____ () C:\Users\***\Downloads\Virtual Router - CHIP-Installer.exe
2014-10-03 16:50 - 2014-10-03 16:50 - 00001678 _____ () C:\Users\Public\Desktop\Goodbye Deponia.lnk
2014-10-03 16:50 - 2014-10-03 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Goodbye Deponia [GOG.com]
2014-09-29 17:49 - 2014-09-29 17:49 - 00000000 ____D () C:\WINDOWS\SysWOW64\NV
2014-09-29 17:49 - 2014-09-29 17:49 - 00000000 ____D () C:\WINDOWS\system32\NV
2014-09-29 17:49 - 2014-09-29 17:49 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-09-29 17:48 - 2014-09-14 00:48 - 31887680 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 24552592 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 20922512 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcompiler.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 20589536 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvwgf2umx.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 19954520 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvd3dumx.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 17259664 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcompiler.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 14026304 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 13939272 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 13157696 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvlddmkm.sys
2014-09-29 17:48 - 2014-09-14 00:48 - 11392576 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 11330776 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 04287296 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 04008592 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 01876296 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6434411.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 01539272 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6434411.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00957584 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00925896 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00919240 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00894096 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00501064 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00417096 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00393024 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00352016 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglshim64.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00348304 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00303600 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglshim32.dll
2014-09-29 17:48 - 2014-09-14 00:48 - 00032576 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvpciflt.sys
2014-09-29 17:42 - 2014-09-04 20:14 - 00038048 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvad64v.sys
2014-09-29 17:42 - 2014-09-04 20:14 - 00032416 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll
2014-09-28 17:59 - 2014-10-15 23:38 - 00012148 _____ () C:\Users\***\Desktop\Long live the queen.odt
2014-09-28 11:52 - 2014-09-28 11:52 - 00000000 ____D () C:\Users\***\AppData\Roaming\com.geetagames.LillyLookingThrough
2014-09-28 11:43 - 2014-09-28 11:43 - 00000000 ____D () C:\Users\***\Downloads\LongLiveTheQueenRetail-1.2.25-win32
2014-09-28 11:42 - 2014-09-28 11:43 - 50610156 _____ () C:\Users\***\Downloads\LongLiveTheQueen-1.2.25_win32_1411580325.zip
2014-09-28 11:32 - 2014-09-28 11:32 - 00000000 ____D () C:\Users\***\Downloads\Glitchhikers
2014-09-28 11:32 - 2014-09-28 11:32 - 00000000 ____D () C:\Users\***\Downloads\__MACOSX
2014-09-25 10:14 - 2014-09-25 10:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-22 21:26 - 2014-09-22 21:27 - 67111021 _____ () C:\Users\***\Downloads\GlitchhikersRelease-Win.zip
2014-09-21 18:34 - 2014-09-21 18:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-19 20:18 - 2014-09-19 20:18 - 00292648 _____ () C:\WINDOWS\Minidump\091914-22234-01.dmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-17 22:10 - 2014-01-30 11:48 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-10-17 22:03 - 2014-04-14 11:40 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-17 22:00 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-10-17 20:32 - 2012-11-21 09:48 - 01575933 _____ () C:\WINDOWS\WindowsUpdate.log
2014-10-17 18:41 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\tracing
2014-10-17 18:18 - 2012-11-21 17:57 - 00754172 _____ () C:\WINDOWS\system32\perfh007.dat
2014-10-17 18:18 - 2012-11-21 17:57 - 00156362 _____ () C:\WINDOWS\system32\perfc007.dat
2014-10-17 18:18 - 2012-07-26 08:28 - 01748838 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-10-17 18:16 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-10-17 17:13 - 2013-08-09 12:10 - 00000000 ____D () C:\Users\***\AppData\Local\Packages
2014-10-17 16:06 - 2013-08-09 12:16 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1429691773-2651506096-3644874853-1002
2014-10-17 15:56 - 2014-04-14 11:40 - 00001128 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-17 12:15 - 2014-03-25 14:28 - 00001610 _____ () C:\WINDOWS\Sandboxie.ini
2014-10-16 21:05 - 2014-04-12 16:42 - 00000000 ____D () C:\Users\***\AppData\Roaming\vlc
2014-10-16 20:13 - 2014-02-28 13:51 - 00000000 ____D () C:\ProgramData\Oracle
2014-10-16 12:26 - 2013-08-09 13:19 - 02114048 ___SH () C:\Users\***\Desktop\Thumbs.db
2014-10-16 11:46 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\rescache
2014-10-16 10:52 - 2013-11-27 21:18 - 00065536 _____ () C:\WINDOWS\system32\Ikeext.etl
2014-10-16 10:52 - 2012-07-26 08:22 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-10-16 10:51 - 2014-07-10 03:51 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-10-16 10:51 - 2012-07-26 09:12 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-10-16 10:51 - 2012-07-26 09:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-16 03:16 - 2014-07-26 16:19 - 00025336 _____ () C:\Users\***\Desktop\Japanisch Material.odt
2014-10-16 02:35 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-10-16 02:32 - 2013-08-14 16:15 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-10-16 02:29 - 2013-08-11 01:08 - 103265616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-10-14 23:16 - 2012-10-10 00:08 - 00173606 _____ () C:\WINDOWS\PFRO.log
2014-10-14 20:54 - 2013-08-09 12:10 - 00000000 ____D () C:\Users\***
2014-10-14 19:39 - 2012-11-21 09:37 - 00000000 ____D () C:\ProgramData\Temp
2014-10-14 19:38 - 2013-08-09 13:45 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster
2014-10-14 19:19 - 2012-07-26 09:12 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-10-14 19:19 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\SysWOW64\GroupPolicy
2014-10-14 19:12 - 2013-08-09 13:52 - 00000000 ____D () C:\Users\***\AppData\Local\Downloaded Installations
2014-10-13 23:46 - 2013-08-10 14:28 - 00000000 ____D () C:\Users\***\AppData\Roaming\RenPy
2014-10-13 23:42 - 2012-07-26 06:26 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-10-13 00:39 - 2013-08-28 15:47 - 00000000 ____D () C:\Users\***\AppData\Roaming\Skype
2014-10-11 23:26 - 2013-08-14 19:49 - 00000000 ____D () C:\ProgramData\Origin
2014-10-11 22:13 - 2013-08-14 19:43 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-10-11 19:38 - 2014-08-26 16:24 - 00000000 ____D () C:\Users\***\Documents\Calibre-Bibliothek
2014-10-11 11:48 - 2013-08-15 02:11 - 00000000 ____D () C:\Fraps
2014-10-09 19:22 - 2013-08-10 14:11 - 00864032 _____ () C:\WINDOWS\DirectX.log
2014-10-09 18:48 - 2013-08-14 19:43 - 00000000 ____D () C:\ProgramData\Electronic Arts
2014-10-09 18:24 - 2011-08-08 18:09 - 00000000 ____D () C:\Users\***\Documents\BioWare
2014-10-08 22:56 - 2013-08-14 19:54 - 00000000 ____D () C:\Program Files\Origin Games
2014-10-05 23:38 - 2013-08-25 11:10 - 00000000 ____D () C:\WINDOWS\Minidump
2014-10-05 23:37 - 2013-08-25 11:10 - 1786039247 _____ () C:\WINDOWS\MEMORY.DMP
2014-10-05 15:01 - 2013-12-13 22:50 - 00000000 ____D () C:\GOG Games
2014-10-05 15:01 - 2010-11-05 13:03 - 00000000 ____D () C:\Users\***\Documents\My Games
2014-10-03 16:51 - 2014-07-23 22:21 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-03 16:29 - 2013-12-13 17:41 - 00000000 ____D () C:\Users\***\AppData\Local\GOG.com
2014-10-01 21:22 - 2013-03-13 20:11 - 00021246 _____ () C:\Users\***\Documents\Vokabel Pulkina.odt
2014-09-29 19:02 - 2013-08-09 12:11 - 00000000 ____D () C:\Users\***\AppData\Roaming\Adobe
2014-09-29 17:49 - 2012-11-21 09:11 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-29 17:43 - 2012-11-21 09:10 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-09-29 17:42 - 2012-07-26 08:21 - 00042125 _____ () C:\WINDOWS\setupact.log
2014-09-29 14:11 - 2013-08-09 13:41 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-29 13:51 - 2014-08-24 18:24 - 00000000 ____D () C:\Users\***\AppData\Local\Depression Quest
2014-09-27 13:50 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\AUInstallAgent
2014-09-27 00:03 - 2011-10-05 17:20 - 00000000 ____D () C:\Users\***\Documents\My Publications
2014-09-26 19:55 - 2010-04-26 16:04 - 00000000 ____D () C:\Users\***\Documents\Literatur
2014-09-26 10:50 - 2013-08-09 12:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-25 10:04 - 2014-04-14 11:42 - 00002186 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-23 10:18 - 2014-01-30 21:42 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-09-22 07:42 - 2014-09-12 15:37 - 00278152 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-09-21 18:34 - 2014-03-18 00:01 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-21 18:34 - 2013-08-27 20:32 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-21 18:34 - 2013-08-27 20:32 - 00000000 ____D () C:\ProgramData\Skype
2014-09-17 15:02 - 2013-08-21 23:05 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-17 03:13 - 2014-07-29 14:56 - 01291280 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspbridge.dll
2014-09-17 03:13 - 2013-12-07 20:47 - 02193560 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2014-09-17 03:12 - 2014-07-29 14:56 - 01715224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspbridge64.dll
2014-09-17 03:12 - 2013-12-07 20:47 - 02799784 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2014-09-17 00:02 - 2013-08-15 03:11 - 00000000 ____D () C:\Program Files (x86)\SpeedFan

Some content of TEMP:
====================
C:\Users\***\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-13 12:03

==================== End Of Log ============================
         

--- --- ---

--- --- ---


Schöne Grüße,
paramo

Java updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

C:\Users\***\AppData\Roaming\CLQHUO
C:\Users\***\AppData\Roaming\UACO
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Fertig

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hier noch die Fixlog

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-10-2014
Ran by *** at 2014-10-18 16:06:34 Run:2
Running from C:\Users***\Desktop
Loaded Profile: ***(Available profiles: ***)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\***\AppData\Roaming\CLQHUO
C:\Users\***\AppData\Roaming\UACO
*****************

C:\Users\***\AppData\Roaming\CLQHUO => Moved successfully.
C:\Users\***\AppData\Roaming\UACO => Moved successfully.

==== End of Fixlog ====
         

Das ging ja schnell
Vielen Dank für deine Hilfe und die Tipps!

Schöne Grüße,
paramo

Gern Geschehen