Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
ads by cinema-plus 1.7c und weitere Seuchen

ads by cinema-plus 1.7c und weitere Seuchen


Log-Analyse und Auswertung: ads by cinema-plus 1.7c und weitere Seuchen

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 23.10.2014, 18:38   #1
Manjetschka
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

ads by cinema-plus 1.7c und weitere Seuchen


Tachschön in die Runde, beim surfen im Internet öffnen sich hunderte von Werbefenstern der unterschiedlichsten Anbieter und zeitweise wird vollkommen ohne Zusammenhang eine Audio über Loch Ness eingespielt?! Das Laufwerk macht deutliche Geräusche. Avira hatte Adware installcore gen 7 gemeldet. Nach drei Browserwechseln habe ich jetzt im Opera Browser einen Adblocker eingesetzt; aktuell gesperrte Ads: 1026 Stück - in wenigen Minuten im www.
Ich hatte bereits gegooglt und einige eurer Tipps ausgeführt. Es wurden immer Probleme ermittelt, aber nie abgestellt. Das Laptop ist erst drei Wochen alt - ich würde gern mit euer Hilfe das Gerät bereinigen, oder platt machen. Anbei die gewünschen Log Files: ich habe noch eigene txt. Dokumente von otl, jrt, malware, avira und adwclean - passen leider nicht alle rein, können nachgeliefert werden, wenn gewünscht. Vielen Dank im Voraus für die Unterstützung!

Alt 23.10.2014, 19:14   #2
schrauber
/// the machine
/// TB-Ausbilder
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

ads by cinema-plus 1.7c und weitere Seuchen


Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________
Alt 23.10.2014, 20:03   #3
Manjetschka
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

ads by cinema-plus 1.7c und weitere Seuchen


Hi Schrauber, alles klar - geht los:

Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:03 on 23/10/2014 (Mimi)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2014
Ran by Mimi at 2014-10-23 18:08:05
Running from C:\Users\Mimi\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.4.144 - Adobe Systems, Inc.)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 6.223.215.5 - Broadcom Corporation)
Broadcom Bluetooth Drivers (HKLM\...\{0A1B4690-E176-4533-8058-939480AEE1D0}) (Version: 12.0.0.9130 - Broadcom Corporation)
Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden
Building the Great Wall of China Collector's Edition (x32 Version: 3.0.2.48 - WildTangent) Hidden
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.) Hidden
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.) Hidden
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.) Hidden
Crazy Chicken Soccer (x32 Version: 2.2.0.110 - WildTangent) Hidden
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.6.3728 - CyberLink Corp.)
CyberLink Media Suite 10 (x32 Version: 10.0.6.3728 - CyberLink Corp.) Hidden
Cyberlink PhotoDirector (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.4.4824 - CyberLink Corp.)
Cyberlink PhotoDirector (x32 Version: 3.0.4.4824 - CyberLink Corp.) Hidden
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.6.3821 - CyberLink Corp.)
CyberLink Power2Go 8 (x32 Version: 8.0.6.3821 - CyberLink Corp.) Hidden
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.6.3604 - CyberLink Corp.)
CyberLink PowerDirector 10 (x32 Version: 10.0.6.3604 - CyberLink Corp.) Hidden
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3.3709 - CyberLink Corp.)
CyberLink PowerDVD 12 (x32 Version: 12.0.3.3709 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.3.3907 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 5.0.3.3907 - CyberLink Corp.) Hidden
DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Energy Star (HKLM\...\{465CA2B6-98AF-4E77-BE22-A908C34BB9EC}) (Version: 1.0.9 - Hewlett-Packard Company)
Evernote v. 5.2 (HKLM-x32\...\{412F6426-A3C7-11E3-8A71-00163E98E7D6}) (Version: 5.2.0.2951 - Evernote Corp.)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP 3D DriveGuard (HKLM-x32\...\{F90A86C9-7779-47DD-AC06-8EE832C55F55}) (Version: 6.0.18.1 - Hewlett-Packard Company)
HP CoolSense (HKLM-x32\...\{E2C8D0C2-1C97-4C05-939A-5B13A0FE655C}) (Version: 2.20.31 - Hewlett-Packard Company)
HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{082B1425-0F24-43FA-9B64-E8F617B0AD3B}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Postscript Converter (Version: 4.5.12202 - Hewlett-Packard) Hidden
HP Recovery Manager (x32 Version: 1.16.1420 - Hewlett-Packard) Hidden
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7493.4758 - Hewlett-Packard)
HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.11 - Hewlett-Packard)
HP SimplePass (Version: 8.01.11 - Hewlett-Packard) Hidden
HP Support Assistant (HKLM-x32\...\{8C696B4B-6AB1-44BC-9416-96EAC474CABE}) (Version: 7.5.2.12 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\...\{DEF23826-DB71-4654-BC00-D5D6C20802EA}) (Version: 1.1.4 - Hewlett-Packard Company)
HP Utility Center (HKLM\...\{36F80C5F-DC0D-4DF4-AF09-DC1867F0EB0A}) (Version: 2.4.4 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)
Inst5675 (Version: 8.01.11 - Softex Inc.) Hidden
Inst5676 (Version: 8.01.11 - Softex Inc.) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3408 - Intel Corporation)
Intel(R) Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.0.0.1002 - Intel Corporation)
Intel(R) Smart Connect Technology (HKLM\...\{8B4EA042-9E21-46FB-8286-225F4D51CC52}) (Version: 4.2.41.2710 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)
Intel(R) Trusted Execution Engine (Version: 1.1.1.1 - Intel Corporation) Hidden
Intel(R) Trusted Execution Engine Driver (Version: 1.0.0.1064 - Intel Corporation) Hidden
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Opera Stable 25.0.1614.50 (HKLM-x32\...\Opera 25.0.1614.50) (Version: 25.0.1614.50 - Opera Software ASA)
Plants vs. Zombies - Game of the Year (x32 Version: 3.0.2.51 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Ranch Rush 2 - Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.273.40 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.24.1218.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7231 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 18.1.5.2 - Synaptics Incorporated)
TeamViewer 9 Host (HKLM-x32\...\TeamViewer 9 Host) (Version: 9.0.32494 - TeamViewer)
Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
Virtual Families (x32 Version: 2.2.0.98 - WildTangent) Hidden
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
WildTangent Games App für HP (x32 Version: 4.0.11.2 - WildTangent) Hidden
WildTangent-Spiele (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
Youda Jewel Shop (x32 Version: 3.0.2.51 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

21-10-2014 00:14:05 Installed SpyHunter

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {03525191-2818-4456-888D-3A7192E2BACE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {17C72762-734C-4B70-AAC2-5D74CC2519EB} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {21199D4C-F9E7-4A63-8AFD-C469861365D8} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {324B0345-C24C-413A-8166-A55DA379CEB2} - System32\Tasks\Opera scheduled Autoupdate 1412885971 => C:\Program Files (x86)\Opera\launcher.exe [2014-10-15] (Opera Software)
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {435A3907-8132-40E2-8BA5-142799C77218} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {4757E115-2C2F-4AE2-BB63-860AD2712FC3} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {537E8FD2-D489-4A80-B2AB-0050A0FBD196} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [2014-03-07] (CyberLink Corp.)
Task: {56BD98E5-BC44-41BC-81FE-3287F5B2237E} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {57775F9D-AFB7-489B-B1FD-3FF1E8656E51} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [2013-11-01] (Hewlett-Packard Development Company, L.P.)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {98292BAF-42C3-4FC1-9056-7EB1EE3B3C57} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {9BF7FFD1-1970-4AB6-8C7C-3D1704385292} - System32\Tasks\DTTZBVQB => C:\Users\Stephan\AppData\Roaming\DTTZBVQB.exe <==== ATTENTION
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A3C40E8E-4E02-4ECF-87EB-E8940B97A994} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-10-15] (Microsoft Corporation)
Task: {A7D760E0-5FF2-4493-BE8A-D04147F5137C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
Task: {C111F0E1-07DD-446E-B7CC-1FED8676AAF5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-12-18] (Hewlett-Packard)
Task: {CBDA51B5-18F3-4C3F-BBAD-09E7E42FDD0E} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-03-18] (Microsoft Corporation)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D352DA66-6B83-46D8-9915-8E7B856C5978} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E320C1A2-C49D-4B28-8CE2-B591B1D3CC3F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company)
Task: {E611AC48-C78A-49B8-BD92-2BBFD6609FCA} - System32\Tasks\BHWWS => C:\Users\Stephan\AppData\Roaming\BHWWS.exe <==== ATTENTION
Task: {E6BC8682-1BE0-47F6-8A8B-AB9F8FEC3788} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {F0B98C9F-6959-4722-99E9-087B230FC7AF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-12-18] (Hewlett-Packard)
Task: C:\Windows\Tasks\BHWWS.job => C:\Users\Stephan\AppData\Roaming\BHWWS.exe <==== ATTENTION
Task: C:\Windows\Tasks\DTTZBVQB.job => C:\Users\Stephan\AppData\Roaming\DTTZBVQB.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2014-03-28 13:31 - 2014-03-28 13:31 - 02110464 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll
2014-03-28 13:27 - 2014-03-28 13:27 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll
2014-03-28 13:27 - 2014-03-28 13:27 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll
2014-03-28 13:27 - 2014-03-28 13:27 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll
2014-03-28 13:48 - 2014-03-28 13:48 - 00367504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll
2014-03-28 13:48 - 2014-03-28 13:48 - 00712080 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll
2013-12-04 08:44 - 2013-12-04 08:44 - 00200168 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
2013-12-04 08:44 - 2013-12-04 08:44 - 00054760 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll
2013-12-04 08:44 - 2013-12-04 08:44 - 00034792 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTNetMon.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-03-28 13:36 - 2014-03-28 13:36 - 00065024 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
2014-07-31 12:16 - 2014-07-31 12:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-07-31 12:16 - 2014-07-31 12:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-10-21 20:25 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-10-21 20:25 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-10-21 20:25 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-10-21 20:25 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-10-21 20:25 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2446055026-3567564273-3713566540-500 - Administrator - Disabled)
Gast (S-1-5-21-2446055026-3567564273-3713566540-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2446055026-3567564273-3713566540-1003 - Limited - Enabled)
Mimi (S-1-5-21-2446055026-3567564273-3713566540-1004 - Administrator - Enabled) => C:\Users\Mimi
Stephan (S-1-5-21-2446055026-3567564273-3713566540-1001 - Administrator - Enabled) => C:\Users\Stephan

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/21/2014 10:42:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 174375

Error: (10/21/2014 10:42:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 174375

Error: (10/21/2014 10:42:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/21/2014 10:09:35 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: There was an error with the Windows Location Provider database

Error: (10/21/2014 08:02:45 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)
Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (10/21/2014 07:47:49 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)
Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (10/21/2014 07:47:27 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)
Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (10/21/2014 07:34:28 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)
Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (10/21/2014 07:34:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)
Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.


System errors:
=============
Error: (10/21/2014 10:42:58 PM) (Source: ACPI) (EventID: 13) (User: )
Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.

Error: (10/21/2014 08:53:23 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\bcmihvsrv64.dll

Error: (10/21/2014 07:34:40 PM) (Source: DCOM) (EventID: 10010) (User: Steppo)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (10/21/2014 07:34:10 PM) (Source: DCOM) (EventID: 10010) (User: Steppo)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (10/21/2014 07:33:40 PM) (Source: DCOM) (EventID: 10010) (User: Steppo)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (10/21/2014 07:33:10 PM) (Source: DCOM) (EventID: 10010) (User: Steppo)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}


Microsoft Office Sessions:
=========================
Error: (10/21/2014 10:42:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 174375

Error: (10/21/2014 10:42:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 174375

Error: (10/21/2014 10:42:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/21/2014 10:09:35 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: -2147024883

Error: (10/21/2014 08:02:45 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)
Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151

Error: (10/21/2014 07:47:49 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)
Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151

Error: (10/21/2014 07:47:27 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)
Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151

Error: (10/21/2014 07:34:28 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)
Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151

Error: (10/21/2014 07:34:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Steppo)
Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU N3530 @ 2.16GHz
Percentage of memory in use: 39%
Total physical RAM: 3988.09 MB
Available physical RAM: 2394.09 MB
Total Pagefile: 4692.09 MB
Available Pagefile: 2564.12 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:678.02 GB) (Free:576.07 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:19.6 GB) (Free:1.91 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 9AF1B1A5)

Partition: GPT Partition Type.

==================== End Of Log ============================

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014
Ran by Mimi (administrator) on STEPPO on 23-10-2014 18:05:46
Running from C:\Users\Mimi\Desktop
Loaded Profiles: Mimi &  (Available profiles: Stephan & Mimi)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7573208 2014-04-22] (Realtek Semiconductor)
HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe [3962936 2014-03-28] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [415288 2014-03-28] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [415288 2014-03-28] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2811120 2014-03-13] (Synaptics Incorporated)
HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [126240 2014-02-13] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [475448 2014-03-26] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-09-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2446055026-3567564273-3713566540-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Pokki] => C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPNOT14/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {FE81BB90-6408-42D2-8133-29E869E8DC35} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{EFBDAE16-3547-4A0A-96FA-C59753428745}: [NameServer] 5.79.84.141,8.38.77.107

FireFox:
========
FF ProfilePath: C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default
FF Homepage: google.de
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Extension: No Name - C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\Extensions\cliqz@cliqz.com [2014-10-21]
FF Extension: No Name - C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\extensions\3c8f3083-413b-4aa6-ad29-fb93d8982e80@gmail.com [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-09-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-09-24] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2251992 2013-11-13] (Broadcom Corporation.)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-01-28] (WildTangent)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2014-01-13] (Hewlett-Packard Company) [File not signed]
R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [469304 2014-03-26] (Hewlett-Packard Development Company, L.P.)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [200168 2013-12-04] ()
R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)
S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2003-04-18] () [File not signed]
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-05-07] (Microsoft Corporation)
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [88064 2014-03-28] (Softex Inc.) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-01-09] (Realtek Semiconductor)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [190704 2014-03-13] (Synaptics Incorporated)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-04-02] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-09-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-09-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-09-24] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-11-13] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7517872 2014-06-12] (Broadcom Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 BtwSerialBus; C:\Windows\System32\drivers\BtwSerialBus.sys [150744 2013-09-09] (Broadcom Corporation.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91912 2013-11-12] (CyberLink)
R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [21408 2013-08-13] ()
R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [21920 2013-08-13] ()
R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [29088 2013-08-13] ()
R3 ISCT; C:\Windows\System32\drivers\ISCTD64.sys [46568 2013-08-13] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-23] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-11] (Intel Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [291544 2014-01-04] (Realtek Semiconductor Corp.)
U5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [466136 2014-01-15] (Realsil Semiconductor Corporation)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2014-03-13] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-03-13] (Synaptics Incorporated)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-23 18:05 - 2014-10-23 18:05 - 00016813 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-10-23 18:05 - 2014-10-23 18:05 - 00000000 ____D () C:\FRST
2014-10-23 18:02 - 2014-10-23 18:03 - 00000470 _____ () C:\Users\Mimi\Desktop\defogger_disable.log
2014-10-23 18:02 - 2014-10-23 18:02 - 00000000 _____ () C:\Users\Mimi\defogger_reenable
2014-10-23 17:59 - 2014-10-23 17:54 - 02112000 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-10-23 17:58 - 2014-10-23 17:56 - 00380416 _____ () C:\Users\Mimi\Desktop\Gmer-19357.exe
2014-10-23 17:58 - 2014-10-23 17:52 - 00050477 _____ () C:\Users\Mimi\Desktop\Defogger.exe
2014-10-23 17:31 - 2014-10-23 17:31 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\70474D78.sys
2014-10-21 23:53 - 2014-10-21 23:53 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Avira
2014-10-21 23:03 - 2013-08-22 15:25 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141021-230357.backup
2014-10-21 20:26 - 2014-10-21 20:26 - 00001414 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-10-21 20:26 - 2014-10-21 20:26 - 00001402 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-10-21 20:26 - 2014-10-21 20:26 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-10-21 20:26 - 2014-10-21 20:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-10-21 20:25 - 2014-10-21 22:46 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-10-21 20:25 - 2014-10-21 20:41 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-10-21 20:25 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-10-21 19:29 - 2014-10-21 19:31 - 01962496 _____ () C:\Users\Mimi\Desktop\adwcleaner_4.001.exe
2014-10-21 17:09 - 2014-10-21 17:09 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Avira
2014-10-21 17:06 - 2014-10-21 17:05 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-21 17:03 - 2014-09-24 12:44 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-21 17:03 - 2014-09-24 12:44 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-21 17:03 - 2014-09-24 12:44 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-10-21 16:44 - 2014-09-22 08:42 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-21 16:22 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-10-21 16:22 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-10-21 02:17 - 2014-10-21 02:17 - 00000000 _____ () C:\autoexec.bat
2014-10-21 02:13 - 2014-10-21 07:49 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-10-21 01:53 - 2014-10-21 01:53 - 00000000 ____D () C:\Synaptics
2014-10-21 01:22 - 2014-10-23 17:31 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-21 01:22 - 2014-10-21 01:23 - 00001125 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-21 01:22 - 2014-10-21 01:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-21 01:21 - 2014-10-21 01:23 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-21 01:21 - 2014-10-21 01:21 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-21 01:21 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-21 01:21 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-21 01:21 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-21 01:02 - 2014-10-21 01:07 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-20 23:29 - 2014-10-20 23:29 - 00602112 _____ (OldTimer Tools) C:\Users\Mimi\Desktop\OTL.exe
2014-10-20 23:22 - 2014-10-20 23:22 - 00000000 ____D () C:\Windows\ERUNT
2014-10-20 23:20 - 2014-10-20 23:21 - 01705698 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT.exe
2014-10-20 23:04 - 2014-10-21 23:24 - 00000000 ____D () C:\AdwCleaner
2014-10-16 21:10 - 2014-10-20 22:34 - 00002166 _____ () C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk
2014-10-16 21:10 - 2014-10-16 21:10 - 00002337 _____ () C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2014-10-16 13:26 - 2014-10-16 13:26 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Opera Software
2014-10-16 13:26 - 2014-10-16 13:26 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Opera Software
2014-10-15 06:31 - 2014-09-28 00:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 06:31 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll
2014-10-15 06:31 - 2014-09-04 01:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll
2014-10-15 06:31 - 2014-09-04 01:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll
2014-10-15 06:30 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 06:30 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-15 06:29 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 06:29 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-15 06:29 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-15 06:29 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-15 06:29 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-15 06:29 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 06:29 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 06:29 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 06:29 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 06:29 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 06:29 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-15 06:29 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 06:29 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-15 06:29 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 06:29 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-15 06:29 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 06:29 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-15 06:29 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 06:29 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 06:29 - 2014-09-19 02:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 06:29 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 06:29 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-15 06:29 - 2014-09-19 02:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-15 06:29 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 06:29 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-15 06:29 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 06:29 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-15 06:29 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-15 06:28 - 2014-09-13 08:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 06:28 - 2014-09-13 07:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-15 06:28 - 2014-09-08 05:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-10-15 06:28 - 2014-09-08 03:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-10-15 06:28 - 2014-09-08 03:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-10-15 06:28 - 2014-09-08 02:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-10-15 06:28 - 2014-09-08 02:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-10-15 06:28 - 2014-09-08 02:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-10-15 06:28 - 2014-09-08 02:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-10-15 06:28 - 2014-09-08 02:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-10-15 06:28 - 2014-09-08 02:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-10-15 06:28 - 2014-09-08 02:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-10-15 06:28 - 2014-09-08 01:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-10-15 06:28 - 2014-09-08 01:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-10-15 06:28 - 2014-09-08 01:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-10-15 06:28 - 2014-09-08 01:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-10-15 06:27 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 06:27 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 06:27 - 2014-08-16 06:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-10-15 06:27 - 2014-08-16 06:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2014-10-15 06:27 - 2014-08-16 06:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-10-15 06:27 - 2014-08-16 05:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-10-15 06:27 - 2014-08-16 05:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-10-15 06:27 - 2014-08-16 05:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-10-15 06:27 - 2014-08-16 05:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-10-15 06:27 - 2014-08-16 05:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll
2014-10-15 06:27 - 2014-08-16 05:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-10-15 06:27 - 2014-08-16 03:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-10-15 06:27 - 2014-08-16 03:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2014-10-15 06:27 - 2014-08-16 02:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2014-10-15 06:27 - 2014-08-16 02:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll
2014-10-15 06:27 - 2014-08-16 02:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll
2014-10-15 06:27 - 2014-08-16 02:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll
2014-10-15 06:27 - 2014-08-16 02:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2014-10-15 06:27 - 2014-08-16 02:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll
2014-10-15 06:27 - 2014-08-16 02:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2014-10-15 06:27 - 2014-08-16 02:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll
2014-10-15 06:27 - 2014-08-16 02:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 06:27 - 2014-08-16 02:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll
2014-10-15 06:27 - 2014-08-16 02:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll
2014-10-15 06:27 - 2014-08-16 02:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll
2014-10-15 06:27 - 2014-08-16 02:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 06:27 - 2014-08-16 02:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll
2014-10-15 06:27 - 2014-08-16 02:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll
2014-10-15 06:27 - 2014-08-16 02:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll
2014-10-15 06:27 - 2014-08-16 02:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 06:27 - 2014-08-16 02:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll
2014-10-15 06:27 - 2014-08-16 02:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll
2014-10-15 06:27 - 2014-08-16 02:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-10-15 06:27 - 2014-08-16 02:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe
2014-10-15 06:27 - 2014-08-16 02:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 06:27 - 2014-08-16 02:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-10-15 06:27 - 2014-08-01 01:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml
2014-10-15 06:26 - 2014-10-10 00:16 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-15 06:26 - 2014-10-09 00:09 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-15 06:26 - 2014-09-19 03:24 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-15 06:26 - 2014-09-13 08:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 06:26 - 2014-09-13 07:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 06:26 - 2014-08-29 03:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-10-15 06:26 - 2014-08-29 01:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-10-15 06:26 - 2014-08-29 01:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-10-15 06:14 - 2014-10-15 06:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-10-15 06:11 - 2014-10-23 17:31 - 00001358 _____ () C:\Windows\Tasks\BHWWS.job
2014-10-15 06:11 - 2014-10-15 06:11 - 00004364 _____ () C:\Windows\System32\Tasks\BHWWS
2014-10-15 06:10 - 2014-10-23 17:31 - 00001708 _____ () C:\Windows\Tasks\DTTZBVQB.job
2014-10-15 06:10 - 2014-10-15 06:10 - 00004714 _____ () C:\Windows\System32\Tasks\DTTZBVQB
2014-10-09 22:19 - 2014-10-16 13:26 - 00003842 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1412885971
2014-10-09 22:19 - 2014-10-16 13:26 - 00001158 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-10-09 22:19 - 2014-10-16 13:26 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-10-09 22:19 - 2014-10-09 22:19 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Opera Software
2014-10-09 22:19 - 2014-10-09 22:19 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Opera Software
2014-10-07 00:55 - 2014-10-07 00:55 - 00000000 ____D () C:\Users\Stephan\Documents\Avatar
2014-10-07 00:54 - 2014-10-07 00:54 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\CyberLink
2014-10-07 00:52 - 2014-10-07 00:52 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Apple Computer
2014-10-06 23:33 - 2014-10-21 17:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-06 23:32 - 2014-10-21 17:03 - 00000000 ____D () C:\ProgramData\Avira
2014-10-06 23:32 - 2014-10-21 17:03 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-06 16:59 - 2014-10-06 16:59 - 00000000 ____D () C:\Users\Mimi\Documents\web
2014-10-06 14:45 - 2014-10-06 14:45 - 00002522 _____ () C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-10-06 05:58 - 2014-10-06 05:58 - 00000000 ____D () C:\Users\Mimi\AppData\Local\CrashDumps
2014-10-01 05:28 - 2014-10-15 06:39 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Apple Computer
2014-09-30 22:46 - 2014-09-30 22:55 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Apple Computer
2014-09-30 22:46 - 2014-09-30 22:46 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Apple Computer
2014-09-30 22:46 - 2014-09-30 22:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-09-30 22:44 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-09-30 22:43 - 2014-09-30 22:44 - 00000000 ____D () C:\Program Files\iTunes
2014-09-30 22:43 - 2014-09-30 22:44 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-09-30 22:43 - 2014-09-30 22:43 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-09-30 22:43 - 2014-09-30 22:43 - 00000000 ____D () C:\Program Files\iPod
2014-09-30 22:41 - 2014-09-30 22:41 - 00002535 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2014-09-30 22:41 - 2014-09-30 22:41 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Apple
2014-09-30 22:41 - 2014-09-30 22:41 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-09-30 22:41 - 2014-09-30 22:41 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-09-28 11:14 - 2014-10-02 07:03 - 00000000 ____D () C:\Users\Stephan\Desktop\Flohmarkt1
2014-09-26 11:35 - 2014-09-26 11:36 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Mozilla
2014-09-26 11:35 - 2014-09-26 11:36 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Mozilla
2014-09-25 22:39 - 2014-09-25 22:39 - 00003130 _____ () C:\Windows\System32\Tasks\{00B59D34-BE6F-4EDF-8D3B-A9BBBA3CCEB6}
2014-09-24 20:18 - 2014-09-24 20:18 - 00000000 ____D () C:\Users\Stephan\AppData\Local\com
2014-09-24 20:10 - 2014-10-16 13:20 - 00000000 ___HD () C:\Users\Public\Temp
2014-09-24 06:41 - 2014-09-26 06:53 - 00000000 ____D () C:\Users\Stephan\AppData\Local\CrashDumps
2014-09-23 22:42 - 2014-10-23 17:34 - 00000000 ____D () C:\Users\Mimi\Documents\Outlook-Dateien
2014-09-23 22:31 - 2014-09-23 22:31 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\WildTangent
2014-09-23 22:22 - 2014-09-23 22:22 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Mozilla
2014-09-23 22:22 - 2014-09-23 22:22 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Mozilla
2014-09-23 22:22 - 2014-09-23 22:22 - 00000000 ____D () C:\ProgramData\Mozilla
2014-09-23 22:21 - 2014-10-16 18:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-23 09:27 - 2014-07-24 11:44 - 16874496 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2014-09-23 09:26 - 2014-07-24 17:28 - 00468288 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2014-09-23 09:26 - 2014-07-24 17:28 - 00412992 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2014-09-23 09:26 - 2014-07-24 17:28 - 00143680 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-09-23 09:26 - 2014-07-24 17:23 - 01519488 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-09-23 09:26 - 2014-07-24 17:20 - 00645592 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-09-23 09:26 - 2014-07-24 17:16 - 02574208 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-09-23 09:26 - 2014-07-24 17:07 - 07424320 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-09-23 09:26 - 2014-07-24 17:07 - 02009920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-09-23 09:26 - 2014-07-24 17:05 - 01660048 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2014-09-23 09:26 - 2014-07-24 17:05 - 01519560 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-09-23 09:26 - 2014-07-24 17:05 - 01488008 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2014-09-23 09:26 - 2014-07-24 17:05 - 01356840 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-09-23 09:26 - 2014-07-24 17:03 - 02141920 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2014-09-23 09:26 - 2014-07-24 17:03 - 00882136 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2014-09-23 09:26 - 2014-07-24 17:03 - 00818624 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2014-09-23 09:26 - 2014-07-24 17:03 - 00360480 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll
2014-09-23 09:26 - 2014-07-24 17:03 - 00205512 _____ (Microsoft Corporation) C:\Windows\system32\mftranscode.dll
2014-09-23 09:26 - 2014-07-24 16:57 - 00475968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-09-23 09:26 - 2014-07-24 15:48 - 02410976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2014-09-23 09:26 - 2014-07-24 15:46 - 00477200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-09-23 09:26 - 2014-07-24 15:36 - 02145472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2014-09-23 09:26 - 2014-07-24 15:36 - 00707536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2014-09-23 09:26 - 2014-07-24 15:36 - 00674512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2014-09-23 09:26 - 2014-07-24 15:36 - 00355800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfreadwrite.dll
2014-09-23 09:26 - 2014-07-24 15:36 - 00180720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mftranscode.dll
2014-09-23 09:26 - 2014-07-24 13:44 - 00674816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-09-23 09:26 - 2014-07-24 13:43 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2014-09-23 09:26 - 2014-07-24 13:42 - 01200640 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2014-09-23 09:26 - 2014-07-24 13:42 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nwifi.sys
2014-09-23 09:26 - 2014-07-24 13:05 - 00287232 _____ (Microsoft Corporation) C:\Windows\system32\usbmon.dll
2014-09-23 09:26 - 2014-07-24 12:20 - 02050560 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2014-09-23 09:26 - 2014-07-24 12:06 - 00438272 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2014-09-23 09:26 - 2014-07-24 11:52 - 00621056 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.dll
2014-09-23 09:26 - 2014-07-24 11:39 - 00770048 _____ (Microsoft Corporation) C:\Windows\system32\WorkfoldersControl.dll
2014-09-23 09:26 - 2014-07-24 11:33 - 01741824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll
2014-09-23 09:26 - 2014-07-24 11:16 - 12730880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2014-09-23 09:26 - 2014-07-24 11:10 - 00540672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comdlg32.dll
2014-09-23 09:26 - 2014-07-24 11:03 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2014-09-23 09:26 - 2014-07-24 11:02 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-09-23 09:26 - 2014-07-24 10:53 - 01261056 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2014-09-23 09:26 - 2014-07-24 10:53 - 00449536 _____ (Microsoft Corporation) C:\Windows\system32\defragsvc.dll
2014-09-23 09:26 - 2014-07-24 10:39 - 02397184 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2014-09-23 09:26 - 2014-07-24 10:38 - 00371200 _____ (Microsoft Corporation) C:\Windows\system32\wlanmsm.dll
2014-09-23 09:26 - 2014-07-24 10:32 - 01532416 _____ (Microsoft Corporation) C:\Windows\system32\wlansvc.dll
2014-09-23 09:26 - 2014-07-24 10:29 - 00439296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Devices.Bluetooth.dll
2014-09-23 09:26 - 2014-07-24 10:22 - 00487936 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2014-09-23 09:26 - 2014-07-24 10:21 - 01231872 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.dll
2014-09-23 09:26 - 2014-07-24 10:21 - 00302080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanmsm.dll
2014-09-23 09:26 - 2014-07-24 10:18 - 00795136 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2014-09-23 09:26 - 2014-07-24 10:10 - 01029632 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-09-23 09:26 - 2014-07-24 10:10 - 00889344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.dll
2014-09-23 09:26 - 2014-07-24 10:10 - 00371712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv
2014-09-23 09:26 - 2014-07-24 10:01 - 01992192 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2014-09-23 09:26 - 2014-07-24 09:50 - 01182208 _____ (Microsoft Corporation) C:\Windows\system32\printui.dll
2014-09-23 09:26 - 2014-07-24 09:44 - 01057792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\printui.dll
2014-09-23 09:26 - 2014-07-24 09:43 - 02696704 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2014-09-23 09:26 - 2014-07-24 09:28 - 01600000 _____ (Microsoft Corporation) C:\Windows\system32\workfolderssvc.dll
2014-09-23 09:26 - 2014-07-24 06:11 - 00513544 _____ () C:\Windows\SysWOW64\locale.nls
2014-09-23 09:26 - 2014-07-24 06:11 - 00513544 _____ () C:\Windows\system32\locale.nls
2014-09-23 09:26 - 2014-07-12 07:55 - 00268288 _____ (Microsoft Corporation) C:\Windows\system32\wisp.dll
2014-09-23 09:26 - 2014-07-12 06:13 - 01417216 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-23 09:26 - 2014-07-04 14:59 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ks.sys
2014-09-23 09:26 - 2014-07-04 11:30 - 00544768 _____ (Microsoft Corporation) C:\Windows\system32\AppxPackaging.dll
2014-09-23 09:26 - 2014-07-04 11:27 - 00474112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxPackaging.dll
2014-09-23 09:26 - 2014-06-27 08:22 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2014-09-23 09:26 - 2014-06-19 04:13 - 00310080 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-09-23 09:26 - 2014-06-14 08:03 - 02389504 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-23 09:26 - 2014-06-14 07:46 - 02071552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-23 09:26 - 2014-06-05 12:18 - 01018368 _____ (Microsoft Corporation) C:\Windows\system32\aclui.dll
2014-09-23 09:26 - 2014-06-05 11:42 - 00889856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aclui.dll
2014-09-23 09:26 - 2014-05-31 07:00 - 01463808 _____ (Microsoft Corporation) C:\Windows\system32\wsecedit.dll
2014-09-23 09:26 - 2014-05-29 08:23 - 00427008 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2014-09-23 09:26 - 2014-05-29 07:25 - 00313856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2014-09-23 09:26 - 2014-05-06 06:41 - 00486744 _____ (Microsoft Corporation) C:\Windows\system32\netcfgx.dll
2014-09-23 09:26 - 2014-05-06 02:55 - 00391000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcfgx.dll
2014-09-23 09:26 - 2014-03-25 04:27 - 00160600 _____ (Microsoft Corporation) C:\Windows\system32\winmmbase.dll
2014-09-23 09:25 - 2014-07-24 17:28 - 00419648 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-09-23 09:25 - 2014-07-24 17:28 - 00280384 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2014-09-23 09:25 - 2014-07-24 17:23 - 00125472 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2014-09-23 09:25 - 2014-07-24 17:20 - 00263400 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe
2014-09-23 09:25 - 2014-07-24 17:16 - 00211216 _____ (Microsoft Corporation) C:\Windows\system32\SndVol.exe
2014-09-23 09:25 - 2014-07-24 17:03 - 00233888 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-09-23 09:25 - 2014-07-24 15:50 - 00098048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2014-09-23 09:25 - 2014-07-24 15:48 - 00180208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SndVol.exe
2014-09-23 09:25 - 2014-07-24 13:51 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDRUM.DLL
2014-09-23 09:25 - 2014-07-24 13:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-09-23 09:25 - 2014-07-24 13:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-09-23 09:25 - 2014-07-24 13:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-09-23 09:25 - 2014-07-24 13:51 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-09-23 09:25 - 2014-07-24 13:46 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2014-09-23 09:25 - 2014-07-24 13:45 - 00076800 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys
2014-09-23 09:25 - 2014-07-24 13:42 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NdisImPlatform.sys
2014-09-23 09:25 - 2014-07-24 13:41 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bridge.sys
2014-09-23 09:25 - 2014-07-24 13:06 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\iasnap.dll
2014-09-23 09:25 - 2014-07-24 13:05 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-09-23 09:25 - 2014-07-24 12:52 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-09-23 09:25 - 2014-07-24 12:51 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRUM.DLL
2014-09-23 09:25 - 2014-07-24 12:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-09-23 09:25 - 2014-07-24 12:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-09-23 09:25 - 2014-07-24 12:51 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-09-23 09:25 - 2014-07-24 12:49 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\WorkFoldersGPExt.dll
2014-09-23 09:25 - 2014-07-24 12:33 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-09-23 09:25 - 2014-07-24 12:32 - 00207360 _____ (Microsoft Corporation) C:\Windows\system32\powercfg.cpl
2014-09-23 09:25 - 2014-07-24 12:18 - 01089024 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
2014-09-23 09:25 - 2014-07-24 12:12 - 00878592 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenter.dll
2014-09-23 09:25 - 2014-07-24 12:10 - 01844224 _____ (Microsoft Corporation) C:\Windows\system32\Display.dll
2014-09-23 09:25 - 2014-07-24 12:10 - 00834560 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-09-23 09:25 - 2014-07-24 12:10 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2014-09-23 09:25 - 2014-07-24 12:10 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasnap.dll
2014-09-23 09:25 - 2014-07-24 12:09 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-09-23 09:25 - 2014-07-24 12:05 - 00187392 _____ (Microsoft Corporation) C:\Windows\system32\WorkFoldersShell.dll
2014-09-23 09:25 - 2014-07-24 11:53 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\prnntfy.dll
2014-09-23 09:25 - 2014-07-24 11:42 - 00206336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\powercfg.cpl
2014-09-23 09:25 - 2014-07-24 11:40 - 00557056 _____ (Microsoft Corporation) C:\Windows\system32\PrintDialogs.dll
2014-09-23 09:25 - 2014-07-24 11:32 - 01048064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpedit.dll
2014-09-23 09:25 - 2014-07-24 11:27 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-09-23 09:25 - 2014-07-24 11:27 - 00779264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-09-23 09:25 - 2014-07-24 11:25 - 00832512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActionCenter.dll
2014-09-23 09:25 - 2014-07-24 11:24 - 01817088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Display.dll
2014-09-23 09:25 - 2014-07-24 11:23 - 00328704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll
2014-09-23 09:25 - 2014-07-24 11:21 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\browser.dll
2014-09-23 09:25 - 2014-07-24 11:18 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\wlansvcpal.dll
2014-09-23 09:25 - 2014-07-24 11:13 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prnntfy.dll
2014-09-23 09:25 - 2014-07-24 11:12 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll
2014-09-23 09:25 - 2014-07-24 11:11 - 00356864 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2014-09-23 09:25 - 2014-07-24 11:11 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll
2014-09-23 09:25 - 2014-07-24 11:04 - 00183808 _____ (Microsoft Corp.) C:\Windows\system32\Defrag.exe
2014-09-23 09:25 - 2014-07-24 10:58 - 00105472 _____ (Microsoft Corporation) C:\Windows\system32\BluetoothApis.dll
2014-09-23 09:25 - 2014-07-24 10:49 - 01361408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-09-23 09:25 - 2014-07-24 10:49 - 01287680 _____ (Microsoft Corporation) C:\Windows\system32\mispace.dll
2014-09-23 09:25 - 2014-07-24 10:49 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\wlanapi.dll
2014-09-23 09:25 - 2014-07-24 10:48 - 00659968 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Devices.Bluetooth.dll
2014-09-23 09:25 - 2014-07-24 10:47 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2014-09-23 09:25 - 2014-07-24 10:43 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshbth.dll
2014-09-23 09:25 - 2014-07-24 10:30 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanapi.dll
2014-09-23 09:25 - 2014-07-24 10:28 - 00595456 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.dll
2014-09-23 09:25 - 2014-07-24 10:23 - 01404416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2014-09-23 09:25 - 2014-07-24 10:20 - 00187392 _____ (Microsoft Corporation) C:\Windows\system32\puiapi.dll
2014-09-23 09:25 - 2014-07-24 10:16 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\VAN.dll
2014-09-23 09:25 - 2014-07-24 10:16 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\wpdbusenum.dll
2014-09-23 09:25 - 2014-07-24 10:15 - 00721408 _____ (Microsoft Corporation) C:\Windows\system32\twinapi.dll
2014-09-23 09:25 - 2014-07-24 10:15 - 00432128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.dll
2014-09-23 09:25 - 2014-07-24 10:10 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-09-23 09:25 - 2014-07-24 10:08 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2014-09-23 09:25 - 2014-07-24 10:08 - 00162816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiapi.dll
2014-09-23 09:25 - 2014-07-24 10:05 - 00448000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VAN.dll
2014-09-23 09:25 - 2014-07-24 09:58 - 00432640 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll
2014-09-23 09:25 - 2014-07-24 09:58 - 00288768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2014-09-23 09:25 - 2014-07-24 09:54 - 01290752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2014-09-23 09:25 - 2014-07-24 09:49 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\DafPrintProvider.dll
2014-09-23 09:25 - 2014-07-24 09:47 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\SettingSync.dll
2014-09-23 09:25 - 2014-07-24 09:43 - 00200192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DafPrintProvider.dll
2014-09-23 09:25 - 2014-07-24 09:41 - 00459264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSync.dll
2014-09-23 09:25 - 2014-07-24 09:33 - 03360768 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-09-23 09:25 - 2014-07-12 06:58 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wisp.dll
2014-09-23 09:25 - 2014-07-04 12:29 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\AppxSip.dll
2014-09-23 09:25 - 2014-07-04 12:20 - 01656832 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2014-09-23 09:25 - 2014-07-04 12:06 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxSip.dll
2014-09-23 09:25 - 2014-07-04 12:00 - 01351168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2014-09-23 09:25 - 2014-06-26 02:32 - 01029632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mispace.dll
2014-09-23 09:25 - 2014-06-26 02:29 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\dab.dll
2014-09-23 09:25 - 2014-06-20 01:37 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2014-09-23 09:25 - 2014-06-07 14:46 - 00216368 _____ (Microsoft Corporation) C:\Windows\system32\rsaenh.dll
2014-09-23 09:25 - 2014-06-07 12:20 - 00189016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rsaenh.dll
2014-09-23 09:25 - 2014-06-05 16:00 - 01118040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2014-09-23 09:25 - 2014-05-31 06:18 - 01319936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsecedit.dll
2014-09-23 09:25 - 2014-05-29 07:20 - 00427520 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-09-23 09:25 - 2014-05-29 06:36 - 00344576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-09-23 09:25 - 2014-05-26 09:26 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\AppxSysprep.dll
2014-09-23 09:25 - 2014-05-10 12:12 - 00387896 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2014-09-23 09:25 - 2014-05-10 10:46 - 00335680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2014-09-23 09:25 - 2014-03-25 04:27 - 00123920 _____ (Microsoft Corporation) C:\Windows\system32\winmm.dll
2014-09-23 09:25 - 2014-03-25 03:20 - 00128568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmm.dll
2014-09-23 09:25 - 2014-03-25 03:20 - 00127544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmmbase.dll
2014-09-23 09:24 - 2014-07-24 13:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTT102.DLL
2014-09-23 09:24 - 2014-07-24 13:51 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-09-23 09:24 - 2014-07-24 13:47 - 00132608 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-09-23 09:24 - 2014-07-24 13:41 - 00118272 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthpan.sys
2014-09-23 09:24 - 2014-07-24 13:22 - 00308736 _____ (Microsoft Corporation) C:\Windows\system32\compstui.dll
2014-09-23 09:24 - 2014-07-24 12:52 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTT102.DLL
2014-09-23 09:24 - 2014-07-24 12:52 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-09-23 09:24 - 2014-07-24 11:14 - 00443904 _____ (Microsoft Corporation) C:\Windows\system32\wlansec.dll
2014-09-23 09:24 - 2014-07-24 11:04 - 00492032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintDialogs.dll
2014-09-23 09:24 - 2014-07-24 10:36 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BluetoothApis.dll
2014-09-23 09:24 - 2014-07-24 10:18 - 01144320 _____ (Microsoft Corporation) C:\Windows\system32\wwanmm.dll
2014-09-23 09:24 - 2014-07-24 10:13 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\SndVolSSO.dll
2014-09-23 09:24 - 2014-07-24 10:00 - 02100736 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlowUI.dll
2014-09-23 09:24 - 2014-07-12 07:23 - 00436224 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2014-09-23 09:24 - 2014-07-12 06:33 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2014-09-23 03:34 - 2014-09-23 03:34 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-23 18:02 - 2014-09-19 12:02 - 00000000 ____D () C:\Users\Mimi
2014-10-23 18:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2014-10-23 17:44 - 2014-09-19 12:03 - 00000000 ____D () C:\Users\Mimi\Documents\Youcam
2014-10-23 17:41 - 2014-09-19 12:17 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{EBD4C036-B3CB-4392-808C-89DA60C8B663}
2014-10-23 17:36 - 2014-09-19 12:11 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2446055026-3567564273-3713566540-1004
2014-10-23 17:31 - 2014-09-19 11:33 - 01870555 _____ () C:\Windows\WindowsUpdate.log
2014-10-22 00:00 - 2014-09-19 11:41 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2446055026-3567564273-3713566540-1001
2014-10-21 23:59 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-10-21 23:28 - 2013-08-22 16:46 - 00032050 _____ () C:\Windows\setupact.log
2014-10-21 23:28 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-21 23:18 - 2014-03-18 11:44 - 00409730 _____ () C:\Windows\PFRO.log
2014-10-21 23:18 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-10-21 22:59 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-10-21 16:55 - 2013-08-22 17:36 - 00000000 ___HD () C:\Windows\ELAMBKUP
2014-10-21 16:54 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-10-21 16:20 - 2014-05-07 19:54 - 00800954 _____ () C:\Windows\system32\perfh007.dat
2014-10-21 16:20 - 2014-05-07 19:54 - 00174458 _____ () C:\Windows\system32\perfc007.dat
2014-10-21 16:20 - 2014-03-18 11:53 - 01921090 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-21 04:24 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2014-10-21 00:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-16 22:47 - 2014-09-19 12:02 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Packages
2014-10-16 19:58 - 2014-09-19 11:41 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9EEBF207-CFCB-43C0-B7A7-45B2F06D4561}
2014-10-16 18:13 - 2014-09-19 11:38 - 00000000 ____D () C:\Users\Stephan\Documents\Youcam
2014-10-16 18:10 - 2014-09-22 16:40 - 00002169 _____ () C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk
2014-10-16 13:33 - 2014-06-12 13:03 - 00000000 ____D () C:\ProgramData\McAfee
2014-10-16 13:33 - 2014-06-12 13:03 - 00000000 ____D () C:\Program Files (x86)\McAfee
2014-10-16 13:31 - 2014-05-07 10:41 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection
2014-10-16 13:17 - 2013-08-22 16:44 - 00492032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData
2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore
2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\MediaViewer
2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\FileManager
2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Camera
2014-10-16 07:23 - 2014-09-20 16:03 - 00000000 ____D () C:\Users\Stephan\Documents\Outlook-Dateien
2014-10-15 07:09 - 2014-09-19 21:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-15 07:04 - 2014-09-21 01:18 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-15 06:47 - 2014-09-21 01:18 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-15 06:45 - 2014-09-22 13:32 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-14 19:41 - 2014-06-12 12:39 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-12 19:05 - 2014-09-22 12:53 - 00000000 ____D () C:\Users\Stephan\Desktop\Rechnungen 
2014-10-11 10:06 - 2014-09-19 11:35 - 00000000 ____D () C:\Users\Stephan
2014-10-09 23:17 - 2014-09-19 21:34 - 00000000 ____D () C:\beide
2014-10-07 00:54 - 2014-06-12 13:02 - 00000000 ____D () C:\Users\Public\CyberLink
2014-10-07 00:53 - 2014-09-19 11:38 - 00000000 ____D () C:\Users\Stephan\AppData\Local\CyberLink
2014-10-07 00:53 - 2014-06-12 12:51 - 00000000 ____D () C:\ProgramData\CyberLink
2014-10-07 00:53 - 2014-05-07 19:34 - 00000000 ___HD () C:\HP
2014-09-30 22:41 - 2014-06-12 12:43 - 00000000 ____D () C:\ProgramData\Apple
2014-09-30 00:45 - 2014-09-22 13:39 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-30 00:45 - 2014-09-22 13:39 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-26 19:37 - 2014-03-18 11:38 - 00000000 ____D () C:\Program Files\Windows Journal
2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\setup
2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\setup
2014-09-26 19:37 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\oobe
2014-09-25 22:20 - 2013-08-22 15:25 - 00000301 _____ () C:\Windows\win.ini
2014-09-25 21:32 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\InputMethod
2014-09-25 21:10 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\registration
2014-09-25 21:09 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\Sysprep

Some content of TEMP:
====================
C:\Users\Mimi\AppData\Local\Temp\avgnt.exe
C:\Users\Mimi\AppData\Local\Temp\sqlite3.dll
C:\Users\Stephan\AppData\Local\Temp\AdhL1.exe
C:\Users\Stephan\AppData\Local\Temp\avgnt.exe
C:\Users\Stephan\AppData\Local\Temp\BackupSetup.exe
C:\Users\Stephan\AppData\Local\Temp\EdSD9.dll
C:\Users\Stephan\AppData\Local\Temp\EdSD9.exe
C:\Users\Stephan\AppData\Local\Temp\jzdp9.dll
C:\Users\Stephan\AppData\Local\Temp\jzdp9.exe
C:\Users\Stephan\AppData\Local\Temp\OnlineBackup.exe
C:\Users\Stephan\AppData\Local\Temp\setup_337.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-21 00:01

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-10-23 18:17:33
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000026 HGST_HTS541075A9E680 rev.JA2OA710 698,64GB
Running: Gmer-19357.exe; Driver: C:\Users\Mimi\AppData\Local\Temp\uwldypoc.sys


---- Kernel code sections - GMER 2.1 ----

.text   C:\Windows\System32\win32k.sys!W32pServiceTable                                                                                 fffff9600013be00 15 bytes [00, F1, F6, 01, 40, 8F, 6C, ...]
.text   C:\Windows\System32\win32k.sys!W32pServiceTable + 16                                                                            fffff9600013be10 11 bytes [00, 6D, FC, FF, 00, A3, C3, ...]

---- User code sections - GMER 2.1 ----

.text   C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe[924] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506            00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe[924] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514            00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe[924] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118               00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe[924] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142               00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5740] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506                      00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5740] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514                      00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5740] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                         00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5740] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                         00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]
.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4468] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506                   00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]
.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4468] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514                   00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]
.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4468] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                      00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]
.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4468] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                      00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe[7716] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506             00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe[7716] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514             00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe[7716] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe[7716] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe[6204] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506         00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe[6204] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514         00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe[6204] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118            00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe[6204] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142            00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe[6184] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506        00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe[6184] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514        00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe[6184] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118           00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe[6184] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142           00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\opbhobrokerdsktop.exe[5364] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506  00007ffcd4a2169a 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\opbhobrokerdsktop.exe[5364] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514  00007ffcd4a216a2 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\opbhobrokerdsktop.exe[5364] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118     00007ffcd4a2181a 4 bytes [A2, D4, FC, 7F]
.text   C:\Program Files\Hewlett-Packard\SimplePass\opbhobrokerdsktop.exe[5364] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142     00007ffcd4a21832 4 bytes [A2, D4, FC, 7F]

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\csrss.exe [7940:4232]                                                                                       fffff96000947b90

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                           unknown MBR code

---- EOF - GMER 2.1 ----
Möchtest du die anderen txt. Dokumente auch gleich haben?

Code:
ATTFilter
# AdwCleaner v4.000 - Bericht erstellt am 20/10/2014 um 23:10:01
# DB v2014-10-19.11
# Aktualisiert 12/10/2014 von Xplode
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Mimi - STEPPO
# Gestartet von : C:\Users\Mimi\Desktop\AdwCleaner_4.000.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : globalUpdate
[#] Dienst Gelöscht : globalUpdatem
Dienst Gelöscht : Scores
Dienst Gelöscht : {6eaeb8af-e4d9-4df5-b9d7-815f2928cdf7}Gw64

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\374311380 
Ordner Gelöscht : C:\Program Files (x86)\Bench
Ordner Gelöscht : C:\Program Files (x86)\globalUpdate
Ordner Gelöscht : C:\Users\Mimi\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\Stephan\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\Stephan\Documents\Optimizer Pro
Ordner Gelöscht : C:\Users\Mimi\AppData\Local\Pokki
Ordner Gelöscht : C:\Users\Public\Pokki
Ordner Gelöscht : C:\Users\Stephan\AppData\Local\Pokki
Ordner Gelöscht : C:\Program Files (x86)\predm
Ordner Gelöscht : C:\Users\Stephan\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\Program Files (x86)\CinPl-2.5cV14.10
Ordner Gelöscht : C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\Extensions\3c8f3083-413b-4aa6-ad29-fb93d8982e80@gmail.com
Ordner Gelöscht : C:\Users\Stephan\AppData\Roaming\Mozilla\Firefox\Profiles\nbpps1a8.default\Extensions\3c8f3083-413b-4aa6-ad29-fb93d8982e80@gmail.com
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Windows\score.exe
Datei Gelöscht : C:\Users\Stephan\AppData\Local\Temp\VOPackage.exe
Datei Gelöscht : C:\Windows\System32\\drivers\{6eaeb8af-e4d9-4df5-b9d7-815f2928cdf7}Gw64.sys
Datei Gelöscht : C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Stephan\AppData\Roaming\Mozilla\Firefox\Profiles\nbpps1a8.default\searchplugins\Web Search.xml

***** [ Tasks ] *****

Task Gelöscht : ASP
Task Gelöscht : globalUpdateUpdateTaskMachineCore
Task Gelöscht : globalUpdateUpdateTaskMachineUA
Task Gelöscht : LaunchSignup
Task Gelöscht : Optimizer Pro Schedule
Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-1
Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-11
Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-2
Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-3
Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-4
Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-5
Task Gelöscht : cb28a990-316d-488c-ad50-248dd0f8de58-5_user

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [termtutor@termtutor.com]
Schlüssel Gelöscht : HKCU\Software\Classes\pokki
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Pokki]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110611311167}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622312267}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655315567}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666316667}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440644314467}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611311167}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110611311167}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622312267}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655315567}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666316667}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611311167}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\InetStat
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\PepperZip
Schlüssel Gelöscht : HKCU\Software\Pokki
Schlüssel Gelöscht : HKCU\Software\Proxy
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\CinPl-2.5cV14.10
Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\SOFTWARE\AdvertisingSupport
Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : HKLM\SOFTWARE\MyBestOffersToday
Schlüssel Gelöscht : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Tutorials
Schlüssel Gelöscht : HKLM\SOFTWARE\CinPl-2.5cV14.10
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17344

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

-\\ Mozilla Firefox v

[7ki9jzgc.default] - Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_CN_Cx0CEU-cMTeldOutkMQym-q8CgvWqCUgJjxwOvjbHw2TbkYVPE4-BLMeojTcznWODomaIx0lQlYZkOzYwHrxK0p_uAXYW[...]
[7ki9jzgc.default] - Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_CN_Cx0CEU-cMTeldOutkMQym-q8CgvWqCUgJjxwOvjbHw2TbkYVPE4-BLMeojTcznWODomaIx0lQlYZkOzYwHr73V71O3OUIqBU_Wtt[...]
[nbpps1a8.default] - Zeile gelöscht : user_pref("extensions.a3c8f3083413b4aa6ad29fb93d8982e80gmailcom63167.63167.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2C%22amazon.com%22%[...]
[nbpps1a8.default] - Zeile gelöscht : user_pref("extensions.a3c8f3083413b4aa6ad29fb93d8982e80gmailcom63167.63167.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2C%22deal[...]
[nbpps1a8.default] - Zeile gelöscht : user_pref("extensions.crossrider.bic", "149120159f832b4c5f69a9ca1214cd52");
[nbpps1a8.default] - Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_CN_Cx0CEU-cMTeldOutkMQym-q8CgvWqCUgJjxwOvjbHw2TbkYVPE4-BLMeojTcznWODomaIx0lQlYZkOzYwHr73V71O3OUIqBU_Wtt[...]

*************************

AdwCleaner[R0].txt - [16861 octets] - [20/10/2014 23:04:40]
AdwCleaner[S0].txt - [14500 octets] - [20/10/2014 23:10:01]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14561 octets] ##########
Habe auch noch otl, jrt, malware und avira files...
__________________
Alt 24.10.2014, 16:26   #4
schrauber
/// the machine
/// TB-Ausbilder
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

ads by cinema-plus 1.7c und weitere Seuchen


MBAM und JRT ebenso laufen und löschen lassen?
AdwCleaner löschen und neu laden, nochmal laufen lassen, alles entfernen, dann ein frisches FRST Log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 25.10.2014, 14:08   #5
Manjetschka
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

Moin Moin, hier die frische frst + adwclean


FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-10-2014
Ran by Mimi (administrator) on STEPPO on 25-10-2014 14:42:41
Running from C:\Users\Mimi\Desktop
Loaded Profile: Mimi (Available profiles: Stephan & Mimi)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17246_none_fa4ae8e99b1f603c\TiWorker.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\Youcam_webcam_camera_video.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7573208 2014-04-22] (Realtek Semiconductor)
HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe [3962936 2014-03-28] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [415288 2014-03-28] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [415288 2014-03-28] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2811120 2014-03-13] (Synaptics Incorporated)
HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [126240 2014-02-13] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [475448 2014-03-26] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-09-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPNOT14/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {FE81BB90-6408-42D2-8133-29E869E8DC35} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{EFBDAE16-3547-4A0A-96FA-C59753428745}: [NameServer] 5.79.84.141,8.38.77.107

FireFox:
========
FF ProfilePath: C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default
FF Homepage: google.de
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Extension: No Name - C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\Extensions\cliqz@cliqz.com [2014-10-21]
FF Extension: No Name - C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\extensions\3c8f3083-413b-4aa6-ad29-fb93d8982e80@gmail.com [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-09-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-09-24] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2251992 2013-11-13] (Broadcom Corporation.)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-01-28] (WildTangent)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2014-01-13] (Hewlett-Packard Company) [File not signed]
R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [469304 2014-03-26] (Hewlett-Packard Development Company, L.P.)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [200168 2013-12-04] ()
R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-05-07] (Microsoft Corporation)
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [88064 2014-03-28] (Softex Inc.) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-01-09] (Realtek Semiconductor)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [190704 2014-03-13] (Synaptics Incorporated)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-04-02] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-09-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-09-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-09-24] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-11-13] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7517872 2014-06-12] (Broadcom Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 BtwSerialBus; C:\Windows\System32\drivers\BtwSerialBus.sys [150744 2013-09-09] (Broadcom Corporation.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91912 2013-11-12] (CyberLink)
R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [21408 2013-08-13] ()
R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [21920 2013-08-13] ()
R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [29088 2013-08-13] ()
R3 ISCT; C:\Windows\System32\drivers\ISCTD64.sys [46568 2013-08-13] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-25] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-11] (Intel Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [291544 2014-01-04] (Realtek Semiconductor Corp.)
U5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [466136 2014-01-15] (Realsil Semiconductor Corporation)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2014-03-13] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-03-13] (Synaptics Incorporated)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-25 14:42 - 2014-10-25 14:42 - 00001199 _____ () C:\Users\Mimi\Desktop\AdwCleaner[S2].txt
2014-10-25 14:42 - 2014-10-25 14:42 - 00000000 ____D () C:\Users\Mimi\Desktop\FRST-OlderVersion
2014-10-25 14:37 - 2014-10-25 14:37 - 00001141 _____ () C:\Users\Mimi\Desktop\AdwCleaner[R3].txt
2014-10-25 14:33 - 2014-10-25 14:33 - 00000747 _____ () C:\Users\Mimi\Desktop\JRTnew.txt
2014-10-25 14:32 - 2014-10-25 14:32 - 00000747 _____ () C:\Users\Mimi\Desktop\JRT.txt
2014-10-25 14:27 - 2014-10-21 20:25 - 01706144 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT_NEW.exe
2014-10-25 14:25 - 2014-10-25 14:25 - 01962496 _____ () C:\Users\Mimi\Desktop\AdwCleaner_4.001.exe
2014-10-23 20:48 - 2014-10-23 20:48 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\00506449.sys
2014-10-23 19:16 - 2014-10-23 19:16 - 00000396 _____ () C:\Users\Mimi\Desktop\Ereignisse.txt
2014-10-23 18:17 - 2014-10-23 18:17 - 00006169 _____ () C:\Users\Mimi\Desktop\Gmer.txt
2014-10-23 18:08 - 2014-10-23 18:09 - 00028032 _____ () C:\Users\Mimi\Desktop\Addition.txt
2014-10-23 18:05 - 2014-10-25 14:42 - 00016373 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-10-23 18:05 - 2014-10-25 14:42 - 00000000 ____D () C:\FRST
2014-10-23 18:02 - 2014-10-23 18:03 - 00000470 _____ () C:\Users\Mimi\Desktop\defogger_disable.txt
2014-10-23 18:02 - 2014-10-23 18:02 - 00000000 _____ () C:\Users\Mimi\defogger_reenable
2014-10-23 17:59 - 2014-10-25 14:42 - 02112512 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-10-23 17:58 - 2014-10-23 17:56 - 00380416 _____ () C:\Users\Mimi\Desktop\Gmer-19357.exe
2014-10-23 17:58 - 2014-10-23 17:52 - 00050477 _____ () C:\Users\Mimi\Desktop\Defogger.exe
2014-10-23 17:31 - 2014-10-23 17:31 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\70474D78.sys
2014-10-21 23:53 - 2014-10-21 23:53 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Avira
2014-10-21 23:03 - 2013-08-22 15:25 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141021-230357.backup
2014-10-21 20:26 - 2014-10-21 20:26 - 00001414 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-10-21 20:26 - 2014-10-21 20:26 - 00001402 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-10-21 20:26 - 2014-10-21 20:26 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-10-21 20:26 - 2014-10-21 20:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-10-21 20:25 - 2014-10-21 22:46 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-10-21 20:25 - 2014-10-21 20:41 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-10-21 20:25 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-10-21 17:09 - 2014-10-21 17:09 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Avira
2014-10-21 17:06 - 2014-10-21 17:05 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-21 17:03 - 2014-09-24 12:44 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-21 17:03 - 2014-09-24 12:44 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-21 17:03 - 2014-09-24 12:44 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-10-21 16:44 - 2014-09-22 08:42 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-21 16:22 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-10-21 16:22 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-10-21 02:17 - 2014-10-21 02:17 - 00000000 _____ () C:\autoexec.bat
2014-10-21 02:13 - 2014-10-21 07:49 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-10-21 01:53 - 2014-10-21 01:53 - 00000000 ____D () C:\Synaptics
2014-10-21 01:51 - 2014-10-21 01:51 - 00001190 _____ () C:\Users\Mimi\Desktop\malware.txt
2014-10-21 01:22 - 2014-10-25 14:41 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-21 01:22 - 2014-10-21 01:23 - 00001125 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-21 01:22 - 2014-10-21 01:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-21 01:21 - 2014-10-21 01:23 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-21 01:21 - 2014-10-21 01:21 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-21 01:21 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-21 01:21 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-21 01:21 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-21 01:02 - 2014-10-21 01:07 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-21 00:04 - 2014-10-21 00:04 - 00132108 _____ () C:\Users\Mimi\Desktop\OTL1.Txt
2014-10-20 23:51 - 2014-10-21 19:45 - 00138812 _____ () C:\Users\Mimi\Desktop\OTL.Txt
2014-10-20 23:51 - 2014-10-21 00:00 - 00132108 _____ () C:\Users\Mimi\Downloads\OTL.Txt
2014-10-20 23:51 - 2014-10-20 23:51 - 00071802 _____ () C:\Users\Mimi\Downloads\Extras.Txt
2014-10-20 23:29 - 2014-10-20 23:29 - 00602112 _____ (OldTimer Tools) C:\Users\Mimi\Desktop\OTL.exe
2014-10-20 23:26 - 2014-10-20 23:26 - 00000613 _____ () C:\Users\Mimi\Desktop\JRT1.txt
2014-10-20 23:22 - 2014-10-20 23:22 - 00000000 ____D () C:\Windows\ERUNT
2014-10-20 23:20 - 2014-10-20 23:21 - 01705698 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT.exe
2014-10-20 23:17 - 2014-10-20 23:17 - 00014694 _____ () C:\Users\Mimi\Desktop\AdwCleaner[S0].txt
2014-10-20 23:04 - 2014-10-25 14:38 - 00000000 ____D () C:\AdwCleaner
2014-10-16 21:10 - 2014-10-20 22:34 - 00002166 _____ () C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk
2014-10-16 21:10 - 2014-10-16 21:10 - 00002337 _____ () C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2014-10-16 13:26 - 2014-10-16 13:26 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Opera Software
2014-10-16 13:26 - 2014-10-16 13:26 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Opera Software
2014-10-15 06:31 - 2014-09-28 00:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 06:31 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll
2014-10-15 06:31 - 2014-09-04 01:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll
2014-10-15 06:31 - 2014-09-04 01:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll
2014-10-15 06:30 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 06:30 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-15 06:29 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 06:29 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-15 06:29 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-15 06:29 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-15 06:29 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-15 06:29 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 06:29 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 06:29 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 06:29 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 06:29 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 06:29 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-15 06:29 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 06:29 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-15 06:29 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 06:29 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-15 06:29 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 06:29 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-15 06:29 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 06:29 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 06:29 - 2014-09-19 02:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 06:29 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 06:29 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-15 06:29 - 2014-09-19 02:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-15 06:29 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 06:29 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-15 06:29 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 06:29 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-15 06:29 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-15 06:28 - 2014-09-13 08:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 06:28 - 2014-09-13 07:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-15 06:28 - 2014-09-08 05:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-10-15 06:28 - 2014-09-08 03:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-10-15 06:28 - 2014-09-08 03:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-10-15 06:28 - 2014-09-08 02:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-10-15 06:28 - 2014-09-08 02:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-10-15 06:28 - 2014-09-08 02:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-10-15 06:28 - 2014-09-08 02:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-10-15 06:28 - 2014-09-08 02:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-10-15 06:28 - 2014-09-08 02:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-10-15 06:28 - 2014-09-08 02:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-10-15 06:28 - 2014-09-08 01:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-10-15 06:28 - 2014-09-08 01:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-10-15 06:28 - 2014-09-08 01:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-10-15 06:28 - 2014-09-08 01:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-10-15 06:27 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 06:27 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 06:27 - 2014-08-16 06:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-10-15 06:27 - 2014-08-16 06:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2014-10-15 06:27 - 2014-08-16 06:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-10-15 06:27 - 2014-08-16 05:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-10-15 06:27 - 2014-08-16 05:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-10-15 06:27 - 2014-08-16 05:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-10-15 06:27 - 2014-08-16 05:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-10-15 06:27 - 2014-08-16 05:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll
2014-10-15 06:27 - 2014-08-16 05:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-10-15 06:27 - 2014-08-16 03:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-10-15 06:27 - 2014-08-16 03:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2014-10-15 06:27 - 2014-08-16 02:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2014-10-15 06:27 - 2014-08-16 02:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll
2014-10-15 06:27 - 2014-08-16 02:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll
2014-10-15 06:27 - 2014-08-16 02:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll
2014-10-15 06:27 - 2014-08-16 02:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2014-10-15 06:27 - 2014-08-16 02:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll
2014-10-15 06:27 - 2014-08-16 02:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2014-10-15 06:27 - 2014-08-16 02:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll
2014-10-15 06:27 - 2014-08-16 02:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 06:27 - 2014-08-16 02:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll
2014-10-15 06:27 - 2014-08-16 02:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll
2014-10-15 06:27 - 2014-08-16 02:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll
2014-10-15 06:27 - 2014-08-16 02:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 06:27 - 2014-08-16 02:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll
2014-10-15 06:27 - 2014-08-16 02:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll
2014-10-15 06:27 - 2014-08-16 02:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll
2014-10-15 06:27 - 2014-08-16 02:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 06:27 - 2014-08-16 02:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll
2014-10-15 06:27 - 2014-08-16 02:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll
2014-10-15 06:27 - 2014-08-16 02:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-10-15 06:27 - 2014-08-16 02:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe
2014-10-15 06:27 - 2014-08-16 02:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 06:27 - 2014-08-16 02:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-10-15 06:27 - 2014-08-01 01:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml
2014-10-15 06:26 - 2014-10-10 00:16 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-15 06:26 - 2014-10-09 00:09 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-15 06:26 - 2014-09-19 03:24 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-15 06:26 - 2014-09-13 08:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 06:26 - 2014-09-13 07:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 06:26 - 2014-08-29 03:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-10-15 06:26 - 2014-08-29 01:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-10-15 06:26 - 2014-08-29 01:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-10-15 06:14 - 2014-10-15 06:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-10-15 06:11 - 2014-10-25 14:41 - 00001358 _____ () C:\Windows\Tasks\BHWWS.job
2014-10-15 06:11 - 2014-10-15 06:11 - 00004364 _____ () C:\Windows\System32\Tasks\BHWWS
2014-10-15 06:10 - 2014-10-25 14:41 - 00001708 _____ () C:\Windows\Tasks\DTTZBVQB.job
2014-10-15 06:10 - 2014-10-15 06:10 - 00004714 _____ () C:\Windows\System32\Tasks\DTTZBVQB
2014-10-09 22:19 - 2014-10-16 13:26 - 00003842 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1412885971
2014-10-09 22:19 - 2014-10-16 13:26 - 00001158 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-10-09 22:19 - 2014-10-16 13:26 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-10-09 22:19 - 2014-10-09 22:19 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Opera Software
2014-10-09 22:19 - 2014-10-09 22:19 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Opera Software
2014-10-07 00:55 - 2014-10-07 00:55 - 00000000 ____D () C:\Users\Stephan\Documents\Avatar
2014-10-07 00:54 - 2014-10-07 00:54 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\CyberLink
2014-10-07 00:52 - 2014-10-07 00:52 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Apple Computer
2014-10-06 23:33 - 2014-10-21 17:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-06 23:32 - 2014-10-21 17:03 - 00000000 ____D () C:\ProgramData\Avira
2014-10-06 23:32 - 2014-10-21 17:03 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-06 16:59 - 2014-10-06 16:59 - 00000000 ____D () C:\Users\Mimi\Documents\web
2014-10-06 14:45 - 2014-10-06 14:45 - 00002522 _____ () C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-10-06 05:58 - 2014-10-06 05:58 - 00000000 ____D () C:\Users\Mimi\AppData\Local\CrashDumps
2014-10-01 05:28 - 2014-10-15 06:39 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Apple Computer
2014-09-30 22:46 - 2014-09-30 22:55 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Apple Computer
2014-09-30 22:46 - 2014-09-30 22:46 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Apple Computer
2014-09-30 22:46 - 2014-09-30 22:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-09-30 22:44 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-09-30 22:43 - 2014-09-30 22:44 - 00000000 ____D () C:\Program Files\iTunes
2014-09-30 22:43 - 2014-09-30 22:44 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-09-30 22:43 - 2014-09-30 22:43 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-09-30 22:43 - 2014-09-30 22:43 - 00000000 ____D () C:\Program Files\iPod
2014-09-30 22:41 - 2014-09-30 22:41 - 00002535 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2014-09-30 22:41 - 2014-09-30 22:41 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Apple
2014-09-30 22:41 - 2014-09-30 22:41 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-09-30 22:41 - 2014-09-30 22:41 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-09-28 11:14 - 2014-10-02 07:03 - 00000000 ____D () C:\Users\Stephan\Desktop\Flohmarkt1
2014-09-26 11:35 - 2014-09-26 11:36 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Mozilla
2014-09-26 11:35 - 2014-09-26 11:36 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Mozilla
2014-09-25 22:39 - 2014-09-25 22:39 - 00003130 _____ () C:\Windows\System32\Tasks\{00B59D34-BE6F-4EDF-8D3B-A9BBBA3CCEB6}

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-25 14:43 - 2014-09-19 12:03 - 00000000 ____D () C:\Users\Mimi\Documents\Youcam
2014-10-25 14:41 - 2014-09-19 12:11 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2446055026-3567564273-3713566540-1004
2014-10-25 14:39 - 2014-03-18 11:44 - 00410048 _____ () C:\Windows\PFRO.log
2014-10-25 14:39 - 2013-08-22 16:46 - 00032332 _____ () C:\Windows\setupact.log
2014-10-25 14:39 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-25 14:38 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-10-25 14:15 - 2014-09-19 11:33 - 01914458 _____ () C:\Windows\WindowsUpdate.log
2014-10-25 14:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2014-10-25 13:43 - 2014-09-19 12:17 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{EBD4C036-B3CB-4392-808C-89DA60C8B663}
2014-10-23 20:09 - 2014-09-19 12:02 - 00000000 ____D () C:\Users\Mimi
2014-10-23 19:58 - 2014-09-19 11:41 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2446055026-3567564273-3713566540-1001
2014-10-23 18:31 - 2014-09-19 11:41 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9EEBF207-CFCB-43C0-B7A7-45B2F06D4561}
2014-10-23 17:34 - 2014-09-23 22:42 - 00000000 ____D () C:\Users\Mimi\Documents\Outlook-Dateien
2014-10-21 23:59 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-10-21 22:59 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-10-21 16:55 - 2013-08-22 17:36 - 00000000 ___HD () C:\Windows\ELAMBKUP
2014-10-21 16:54 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-10-21 16:20 - 2014-05-07 19:54 - 00800954 _____ () C:\Windows\system32\perfh007.dat
2014-10-21 16:20 - 2014-05-07 19:54 - 00174458 _____ () C:\Windows\system32\perfc007.dat
2014-10-21 16:20 - 2014-03-18 11:53 - 01921090 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-21 04:24 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2014-10-21 00:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-16 22:47 - 2014-09-19 12:02 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Packages
2014-10-16 18:13 - 2014-09-19 11:38 - 00000000 ____D () C:\Users\Stephan\Documents\Youcam
2014-10-16 18:10 - 2014-09-22 16:40 - 00002169 _____ () C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk
2014-10-16 18:06 - 2014-09-23 22:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-16 13:33 - 2014-06-12 13:03 - 00000000 ____D () C:\ProgramData\McAfee
2014-10-16 13:33 - 2014-06-12 13:03 - 00000000 ____D () C:\Program Files (x86)\McAfee
2014-10-16 13:31 - 2014-05-07 10:41 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection
2014-10-16 13:20 - 2014-09-24 20:10 - 00000000 ___HD () C:\Users\Public\Temp
2014-10-16 13:17 - 2013-08-22 16:44 - 00492032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData
2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore
2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\MediaViewer
2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\FileManager
2014-10-16 07:31 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Camera
2014-10-16 07:23 - 2014-09-20 16:03 - 00000000 ____D () C:\Users\Stephan\Documents\Outlook-Dateien
2014-10-15 07:09 - 2014-09-19 21:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-15 07:04 - 2014-09-21 01:18 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-15 06:47 - 2014-09-21 01:18 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-15 06:45 - 2014-09-22 13:32 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-14 19:41 - 2014-06-12 12:39 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-12 19:05 - 2014-09-22 12:53 - 00000000 ____D () C:\Users\Stephan\Desktop\Rechnungen Möbeltaxi
2014-10-11 10:06 - 2014-09-19 11:35 - 00000000 ____D () C:\Users\Stephan
2014-10-09 23:17 - 2014-09-19 21:34 - 00000000 ____D () C:\beide
2014-10-07 00:54 - 2014-06-12 13:02 - 00000000 ____D () C:\Users\Public\CyberLink
2014-10-07 00:53 - 2014-09-19 11:38 - 00000000 ____D () C:\Users\Stephan\AppData\Local\CyberLink
2014-10-07 00:53 - 2014-06-12 12:51 - 00000000 ____D () C:\ProgramData\CyberLink
2014-10-07 00:53 - 2014-05-07 19:34 - 00000000 ___HD () C:\HP
2014-09-30 22:41 - 2014-06-12 12:43 - 00000000 ____D () C:\ProgramData\Apple
2014-09-30 00:45 - 2014-09-22 13:39 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-30 00:45 - 2014-09-22 13:39 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-26 19:37 - 2014-03-18 11:38 - 00000000 ____D () C:\Program Files\Windows Journal
2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\setup
2014-09-26 19:37 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\setup
2014-09-26 19:37 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\oobe
2014-09-26 06:53 - 2014-09-24 06:41 - 00000000 ____D () C:\Users\Stephan\AppData\Local\CrashDumps
2014-09-25 22:20 - 2013-08-22 15:25 - 00000301 _____ () C:\Windows\win.ini
2014-09-25 21:32 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\InputMethod
2014-09-25 21:10 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\registration
2014-09-25 21:09 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\Sysprep

Some content of TEMP:
====================
C:\Users\Mimi\AppData\Local\Temp\avgnt.exe
C:\Users\Mimi\AppData\Local\Temp\Quarantine.exe
C:\Users\Mimi\AppData\Local\Temp\sqlite3.dll
C:\Users\Stephan\AppData\Local\Temp\AdhL1.exe
C:\Users\Stephan\AppData\Local\Temp\avgnt.exe
C:\Users\Stephan\AppData\Local\Temp\BackupSetup.exe
C:\Users\Stephan\AppData\Local\Temp\EdSD9.dll
C:\Users\Stephan\AppData\Local\Temp\EdSD9.exe
C:\Users\Stephan\AppData\Local\Temp\jzdp9.dll
C:\Users\Stephan\AppData\Local\Temp\jzdp9.exe
C:\Users\Stephan\AppData\Local\Temp\OnlineBackup.exe
C:\Users\Stephan\AppData\Local\Temp\setup_337.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-21 00:01

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---
Code:
ATTFilter
# AdwCleaner v4.001 - Bericht erstellt am 25/10/2014 um 14:38:07
# DB v2014-10-23.2
# Aktualisiert 20/10/2014 von Xplode
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Mimi - STEPPO
# Gestartet von : C:\Users\Mimi\Desktop\AdwCleaner_4.001.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : KMService

***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}

***** [ Browser ] *****

-\\ Internet Explorer v0.0.0.0


-\\ Mozilla Firefox v


*************************

AdwCleaner[R0].txt - [16861 octets] - [20/10/2014 23:04:40]
AdwCleaner[R1].txt - [7275 octets] - [21/10/2014 23:14:07]
AdwCleaner[R2].txt - [963 octets] - [21/10/2014 23:22:04]
AdwCleaner[R3].txt - [1141 octets] - [25/10/2014 14:33:30]
AdwCleaner[S0].txt - [14694 octets] - [20/10/2014 23:10:01]
AdwCleaner[S1].txt - [7282 octets] - [21/10/2014 23:17:23]
AdwCleaner[S2].txt - [1059 octets] - [25/10/2014 14:38:07]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1119 octets] ##########
Leider öffnen sich immer noch eigenständig folgende tabs: icmwebserv.com; alh.gogorithm.com/WLBidRequestHandler; png.mecoolidea.com wird von Malwarebytes geblockt.

Geändert von Manjetschka (25.10.2014 um 14:15 Uhr)

Alt 26.10.2014, 10:22   #6
schrauber
/// the machine
/// TB-Ausbilder
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

ads by cinema-plus 1.7c und weitere Seuchen


In allen Browsern oder nur in einem speziellen?
__________________
--> ads by cinema-plus 1.7c und weitere Seuchen

Alt 26.10.2014, 15:12   #7
Manjetschka
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

Moinsen


habe zzt. nur den Opera Browser laufen. Soll ich die anderen noch mal durchtesten?

Ich lösche Opera mal und probiere die anderen - wobei Opera jetzt schon nach dem Explorer und Firefox mein dritter Browser-Versuch war...

Habe noch mal neue Browserversionen über chip heruntergeladen und und installiert. In diesem Zuge hat sich auch wieder cliqz mit firefox im Hintergrung installiert und sowohl adwarecleaner als auch spybot haben weiterhin Funde gemeldet. Ich poste gleich das logfile. Der Laptop ist auch weiterhin sehr langsam und die Browser musste ich über einen Stick imporieren weil die Browserwahl über microsoft nicht funktioniert hat.

Code:
ATTFilter
Search results from Spybot - Search & Destroy

26.10.2014 14:31:08
Scan took 00:45:50.
16 items found.

7-Zip: [SBI $12C3A52C] Folder history (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1004\Software\7-ZIP\FM\FolderHistory

7-Zip: [SBI $3D5692BD] Last used folder (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1004\Software\7-ZIP\FM\PanelPath0

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1001\Software\Microsoft\Internet Explorer\TypedURLs

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\TypedURLs

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1004\Software\Microsoft\Internet Explorer\TypedURLs

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-2446055026-3567564273-3713566540-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Cookie: [SBI $49804B54] Browser: Cookie (8) (Browser: Cookie, nothing done)
  

Cache: [SBI $49804B54] Browser: Cache (127) (Browser: Cache, nothing done)
  

Verlauf: [SBI $49804B54] Browser: History (43) (Browser: History, nothing done)
  

Cookie: [SBI $49804B54] Browser: Cookie (71) (Browser: Cookie, nothing done)
  


--- Spybot - Search & Destroy version: 2.4.40.131  DLL (build: 20140425) ---

2014-06-24 blindman.exe (2.4.40.151)
2014-06-24 explorer.exe (2.4.40.181)
2014-06-24 SDBootCD.exe (2.4.40.109)
2014-06-24 SDCleaner.exe (2.4.40.110)
2014-06-24 SDDelFile.exe (2.4.40.94)
2013-06-17 SDDisableProxy.exe
2014-06-24 SDFiles.exe (2.4.40.135)
2014-06-24 SDFileScanHelper.exe (2.4.40.1)
2014-06-24 SDFSSvc.exe (2.4.40.217)
2014-06-24 SDHelp.exe (2.4.40.1)
2014-04-25 SDHookHelper.exe (2.3.39.2)
2014-04-25 SDHookInst32.exe (2.3.39.2)
2014-04-25 SDHookInst64.exe (2.3.39.2)
2014-06-24 SDImmunize.exe (2.4.40.130)
2014-06-24 SDLogReport.exe (2.4.40.107)
2014-06-24 SDOnAccess.exe (2.4.40.11)
2014-06-24 SDPESetup.exe (2.4.40.3)
2014-06-24 SDPEStart.exe (2.4.40.86)
2014-06-24 SDPhoneScan.exe (2.4.40.28)
2014-06-24 SDPRE.exe (2.4.40.22)
2014-06-24 SDPrepPos.exe (2.4.40.15)
2014-06-24 SDQuarantine.exe (2.4.40.103)
2014-06-24 SDRootAlyzer.exe (2.4.40.116)
2014-06-24 SDSBIEdit.exe (2.4.40.39)
2014-06-24 SDScan.exe (2.4.40.181)
2014-06-24 SDScript.exe (2.4.40.54)
2014-06-24 SDSettings.exe (2.4.40.139)
2014-06-24 SDShell.exe (2.4.40.2)
2014-06-24 SDShred.exe (2.4.40.108)
2014-06-24 SDSysRepair.exe (2.4.40.102)
2014-06-24 SDTools.exe (2.4.40.157)
2014-06-24 SDTray.exe (2.4.40.129)
2014-06-27 SDUpdate.exe (2.4.40.94)
2014-06-27 SDUpdSvc.exe (2.4.40.77)
2014-06-24 SDWelcome.exe (2.4.40.130)
2014-04-25 SDWSCSvc.exe (2.3.39.2)
2014-05-20 spybotsd2-install-bdcore-update.exe (2.3.39.0)
2014-07-30 spybotsd2-translation-esx.exe
2013-06-18 spybotsd2-translation-frx.exe
2014-08-24 spybotsd2-translation-hux2.exe
2014-09-30 spybotsd2-translation-nlx2.exe
2014-10-21 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2014-04-25 NotificationSpreader.dll
2014-06-24 SDAdvancedCheckLibrary.dll (2.4.40.98)
2014-04-25 SDAV.dll
2014-06-24 SDECon32.dll (2.4.40.114)
2014-06-24 SDECon64.dll (2.3.39.113)
2014-06-24 SDEvents.dll (2.4.40.2)
2014-06-24 SDFileScanLibrary.dll (2.4.40.14)
2014-04-25 SDHook32.dll (2.3.39.2)
2014-04-25 SDHook64.dll (2.3.39.2)
2014-06-24 SDImmunizeLibrary.dll (2.4.40.2)
2014-06-24 SDLicense.dll (2.4.40.0)
2014-06-24 SDLists.dll (2.4.40.4)
2014-06-24 SDResources.dll (2.4.40.7)
2014-06-24 SDScanLibrary.dll (2.4.40.131)
2014-06-24 SDTasks.dll (2.4.40.15)
2014-06-24 SDWinLogon.dll (2.4.40.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2014-06-24 Tools.dll (2.4.40.36)
2014-03-04 Includes\Adware-000.sbi (*)
2014-01-07 Includes\Adware-001.sbi (*)
2014-10-13 Includes\Adware-C.sbi (*)
2014-01-12 Includes\Adware.sbi (*)
2014-01-12 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2014-01-07 Includes\Dialer-000.sbi (*)
2014-01-07 Includes\Dialer-001.sbi (*)
2014-01-07 Includes\Dialer-C.sbi (*)
2014-01-12 Includes\Dialer.sbi (*)
2014-01-12 Includes\DialerC.sbi (*)
2014-01-08 Includes\Fraud-000.sbi (*)
2014-01-08 Includes\Fraud-001.sbi (*)
2014-03-30 Includes\Fraud-002.sbi (*)
2014-01-08 Includes\Fraud-003.sbi (*)
2012-11-13 Includes\HeavyDuty.sbi (*)
2014-01-07 Includes\Hijackers-000.sbi (*)
2014-01-07 Includes\Hijackers-001.sbi (*)
2014-01-07 Includes\Hijackers-C.sbi (*)
2014-01-12 Includes\Hijackers.sbi (*)
2014-01-12 Includes\HijackersC.sbi (*)
2014-01-07 Includes\iPhone-000.sbi (*)
2014-01-07 Includes\iPhone.sbi (*)
2014-01-07 Includes\Keyloggers-000.sbi (*)
2014-09-23 Includes\Keyloggers-C.sbi (*)
2014-01-12 Includes\Keyloggers.sbi (*)
2014-01-12 Includes\KeyloggersC.sbi (*)
2014-10-06 Includes\Malware-000.sbi (*)
2014-01-08 Includes\Malware-001.sbi (*)
2014-01-08 Includes\Malware-002.sbi (*)
2014-02-04 Includes\Malware-003.sbi (*)
2014-01-27 Includes\Malware-004.sbi (*)
2014-04-14 Includes\Malware-005.sbi (*)
2014-02-25 Includes\Malware-006.sbi (*)
2014-01-08 Includes\Malware-007.sbi (*)
2014-10-13 Includes\Malware-C.sbi (*)
2014-01-12 Includes\Malware.sbi (*)
2013-12-22 Includes\MalwareC.sbi (*)
2014-01-14 Includes\PUPS-000.sbi (*)
2014-01-14 Includes\PUPS-001.sbi (*)
2014-01-14 Includes\PUPS-002.sbi (*)
2014-10-13 Includes\PUPS-C.sbi (*)
2012-11-13 Includes\PUPS.sbi (*)
2014-01-06 Includes\PUPSC.sbi (*)
2014-01-07 Includes\Security-000.sbi (*)
2014-01-07 Includes\Security-C.sbi (*)
2014-01-20 Includes\Security.sbi (*)
2014-01-20 Includes\SecurityC.sbi (*)
2014-01-07 Includes\Spyware-000.sbi (*)
2014-01-07 Includes\Spyware-001.sbi (*)
2014-01-07 Includes\Spyware-C.sbi (*)
2014-01-20 Includes\Spyware.sbi (*)
2014-01-20 Includes\SpywareC.sbi (*)
2011-06-06 Includes\Tracks.sbi (*)
2012-11-18 Includes\Tracks.uti (*)
2014-01-14 Includes\Trojans-000.sbi (*)
2014-01-14 Includes\Trojans-001.sbi (*)
2014-01-14 Includes\Trojans-002.sbi (*)
2014-01-14 Includes\Trojans-003.sbi (*)
2014-01-14 Includes\Trojans-004.sbi (*)
2014-03-18 Includes\Trojans-005.sbi (*)
2014-07-08 Includes\Trojans-006.sbi (*)
2014-01-14 Includes\Trojans-007.sbi (*)
2014-07-08 Includes\Trojans-008.sbi (*)
2014-07-08 Includes\Trojans-009.sbi (*)
2014-10-13 Includes\Trojans-C.sbi (*)
2014-01-14 Includes\Trojans-OG-000.sbi (*)
2014-01-14 Includes\Trojans-TD-000.sbi (*)
2014-01-14 Includes\Trojans-VM-000.sbi (*)
2014-01-14 Includes\Trojans-VM-001.sbi (*)
2014-01-14 Includes\Trojans-VM-002.sbi (*)
2014-01-14 Includes\Trojans-VM-003.sbi (*)
2014-01-14 Includes\Trojans-VM-004.sbi (*)
2014-01-14 Includes\Trojans-VM-005.sbi (*)
2014-01-14 Includes\Trojans-VM-006.sbi (*)
2014-01-14 Includes\Trojans-VM-007.sbi (*)
2014-01-14 Includes\Trojans-VM-008.sbi (*)
2014-01-14 Includes\Trojans-VM-009.sbi (*)
2014-01-14 Includes\Trojans-VM-010.sbi (*)
2014-01-14 Includes\Trojans-VM-011.sbi (*)
2014-01-14 Includes\Trojans-VM-012.sbi (*)
2014-01-14 Includes\Trojans-VM-013.sbi (*)
2014-01-14 Includes\Trojans-VM-014.sbi (*)
2014-01-14 Includes\Trojans-VM-015.sbi (*)
2014-01-14 Includes\Trojans-VM-016.sbi (*)
2014-01-14 Includes\Trojans-VM-017.sbi (*)
2014-01-14 Includes\Trojans-VM-018.sbi (*)
2014-01-14 Includes\Trojans-VM-019.sbi (*)
2014-01-14 Includes\Trojans-VM-020.sbi (*)
2014-01-14 Includes\Trojans-VM-021.sbi (*)
2014-01-14 Includes\Trojans-VM-022.sbi (*)
2014-01-14 Includes\Trojans-VM-023.sbi (*)
2014-01-14 Includes\Trojans-VM-024.sbi (*)
2014-01-14 Includes\Trojans-ZB-000.sbi (*)
2014-01-14 Includes\Trojans-ZL-000.sbi (*)
2014-01-08 Includes\Trojans.sbi (*)
2014-01-15 Includes\TrojansC-01.sbi (*)
2014-01-15 Includes\TrojansC-02.sbi (*)
2014-01-15 Includes\TrojansC-03.sbi (*)
2014-01-15 Includes\TrojansC-04.sbi (*)
2014-01-15 Includes\TrojansC-05.sbi (*)
2014-01-08 Includes\TrojansC.sbi (*)
alh, icm und png sind zzt. nicht mehr zu sehen und auch cinema plus ist weg. Kann aber auch am adblocker liegen.


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2014
Ran by Mimi (administrator) on STEPPO on 26-10-2014 15:07:32
Running from C:\Users\Mimi\Desktop\Security
Loaded Profile: Mimi (Available profiles: Stephan & Mimi)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9654.17044_x64__8wekyb3d8bbwe\glcnd.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7573208 2014-04-22] (Realtek Semiconductor)
HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe [3962936 2014-03-28] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [415288 2014-03-28] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [415288 2014-03-28] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2811120 2014-03-13] (Synaptics Incorporated)
HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [126240 2014-02-13] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [475448 2014-03-26] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-09-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPNOT14/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {FE81BB90-6408-42D2-8133-29E869E8DC35} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{EFBDAE16-3547-4A0A-96FA-C59753428745}: [NameServer] 5.79.84.141,8.38.77.107

FireFox:
========
FF ProfilePath: C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default
FF Homepage: google.de
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-09-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-09-24] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2251992 2013-11-13] (Broadcom Corporation.)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-01-28] (WildTangent)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2014-01-13] (Hewlett-Packard Company) [File not signed]
R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [469304 2014-03-26] (Hewlett-Packard Development Company, L.P.)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [200168 2013-12-04] ()
R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-05-07] (Microsoft Corporation)
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [88064 2014-03-28] (Softex Inc.) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-01-08] (Realtek Semiconductor)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [190704 2014-03-13] (Synaptics Incorporated)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-04-02] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-09-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-09-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-09-24] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-11-13] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7517872 2014-06-12] (Broadcom Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 BtwSerialBus; C:\Windows\System32\drivers\BtwSerialBus.sys [150744 2013-09-09] (Broadcom Corporation.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91912 2013-11-12] (CyberLink)
R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [21408 2013-08-13] ()
R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [21920 2013-08-13] ()
R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [29088 2013-08-13] ()
R3 ISCT; C:\Windows\System32\drivers\ISCTD64.sys [46568 2013-08-13] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-26] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-11] (Intel Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [291544 2014-01-04] (Realtek Semiconductor Corp.)
U5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [466136 2014-01-14] (Realsil Semiconductor Corporation)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2014-03-13] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-03-13] (Synaptics Incorporated)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-26 14:41 - 2014-10-26 15:07 - 00000000 ____D () C:\Users\Mimi\Desktop\Security
2014-10-26 12:05 - 2014-10-26 12:05 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safari.lnk
2014-10-26 12:05 - 2014-10-26 12:05 - 00000000 ____D () C:\Program Files (x86)\Safari
2014-10-26 11:59 - 2014-10-26 11:59 - 00929871 _____ () C:\Users\Mimi\Downloads\adblock_plus-2.6.5-an_tb_fx_sm.zip
2014-10-26 11:59 - 2014-10-21 12:13 - 00979610 _____ () C:\Users\Mimi\Downloads\adblock_plus-2.6.5-an+tb+fx+sm.xpi
2014-10-26 11:52 - 2014-10-26 11:52 - 00003836 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1414320714
2014-10-26 11:51 - 2014-10-26 11:51 - 00001158 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-10-26 11:50 - 2014-10-26 11:50 - 00001556 _____ () C:\Windows\IE11_main.log
2014-10-26 11:38 - 2014-10-26 11:38 - 00001182 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-26 11:38 - 2014-10-26 11:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-23 19:48 - 2014-10-23 19:48 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\00506449.sys
2014-10-23 17:05 - 2014-10-26 15:07 - 00000000 ____D () C:\FRST
2014-10-23 17:02 - 2014-10-23 17:02 - 00000000 _____ () C:\Users\Mimi\defogger_reenable
2014-10-23 16:31 - 2014-10-23 16:31 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\70474D78.sys
2014-10-21 22:53 - 2014-10-21 22:53 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Avira
2014-10-21 22:03 - 2013-08-22 14:25 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141021-230357.backup
2014-10-21 19:26 - 2014-10-21 19:26 - 00001414 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-10-21 19:26 - 2014-10-21 19:26 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-10-21 19:26 - 2014-10-21 19:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-10-21 19:25 - 2014-10-21 21:46 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-10-21 19:25 - 2014-10-21 19:41 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-10-21 19:25 - 2013-09-20 09:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-10-21 16:09 - 2014-10-21 16:09 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Avira
2014-10-21 16:06 - 2014-10-21 16:05 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-21 16:03 - 2014-09-24 11:44 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-21 16:03 - 2014-09-24 11:44 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-21 16:03 - 2014-09-24 11:44 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-10-21 15:44 - 2014-09-22 07:42 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-21 15:22 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-10-21 15:22 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-10-21 01:17 - 2014-10-21 01:17 - 00000000 _____ () C:\autoexec.bat
2014-10-21 01:13 - 2014-10-21 06:49 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-10-21 00:53 - 2014-10-21 00:53 - 00000000 ____D () C:\Synaptics
2014-10-21 00:22 - 2014-10-26 14:57 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-21 00:22 - 2014-10-21 00:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-21 00:21 - 2014-10-21 00:23 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-21 00:21 - 2014-10-21 00:21 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-21 00:21 - 2014-10-01 10:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-21 00:21 - 2014-10-01 10:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-21 00:21 - 2014-10-01 10:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-21 00:02 - 2014-10-21 00:07 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-20 22:51 - 2014-10-20 23:00 - 00132108 _____ () C:\Users\Mimi\Downloads\OTL.Txt
2014-10-20 22:51 - 2014-10-20 22:51 - 00071802 _____ () C:\Users\Mimi\Downloads\Extras.Txt
2014-10-20 22:22 - 2014-10-20 22:22 - 00000000 ____D () C:\Windows\ERUNT
2014-10-20 22:04 - 2014-10-26 14:54 - 00000000 ____D () C:\AdwCleaner
2014-10-16 20:10 - 2014-10-20 21:34 - 00002166 _____ () C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk
2014-10-16 20:10 - 2014-10-16 20:10 - 00002337 _____ () C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2014-10-16 12:26 - 2014-10-16 12:26 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Opera Software
2014-10-16 12:26 - 2014-10-16 12:26 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Opera Software
2014-10-15 05:31 - 2014-09-27 23:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 05:31 - 2014-09-04 01:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll
2014-10-15 05:31 - 2014-09-04 00:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll
2014-10-15 05:31 - 2014-09-04 00:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll
2014-10-15 05:30 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 05:30 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-15 05:29 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 05:29 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-15 05:29 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-15 05:29 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-15 05:29 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-15 05:29 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 05:29 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 05:29 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 05:29 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 05:29 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 05:29 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-15 05:29 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 05:29 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-15 05:29 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 05:29 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-15 05:29 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 05:29 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-15 05:29 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 05:29 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 05:29 - 2014-09-19 01:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 05:29 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 05:29 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-15 05:29 - 2014-09-19 01:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-15 05:29 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 05:29 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-15 05:29 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 05:29 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-15 05:29 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-15 05:28 - 2014-09-13 07:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 05:28 - 2014-09-13 06:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-15 05:28 - 2014-09-08 04:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-10-15 05:28 - 2014-09-08 02:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-10-15 05:28 - 2014-09-08 02:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-10-15 05:28 - 2014-09-08 01:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-10-15 05:28 - 2014-09-08 01:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-10-15 05:28 - 2014-09-08 01:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-10-15 05:28 - 2014-09-08 01:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-10-15 05:28 - 2014-09-08 01:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-10-15 05:28 - 2014-09-08 01:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-10-15 05:28 - 2014-09-08 01:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-10-15 05:28 - 2014-09-08 00:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-10-15 05:28 - 2014-09-08 00:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-10-15 05:28 - 2014-09-08 00:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-10-15 05:28 - 2014-09-08 00:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-10-15 05:27 - 2014-09-04 01:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 05:27 - 2014-09-04 01:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 05:27 - 2014-08-16 05:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-10-15 05:27 - 2014-08-16 05:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2014-10-15 05:27 - 2014-08-16 05:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-10-15 05:27 - 2014-08-16 04:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-10-15 05:27 - 2014-08-16 04:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-10-15 05:27 - 2014-08-16 04:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-10-15 05:27 - 2014-08-16 04:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-10-15 05:27 - 2014-08-16 04:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll
2014-10-15 05:27 - 2014-08-16 04:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-10-15 05:27 - 2014-08-16 02:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-10-15 05:27 - 2014-08-16 02:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2014-10-15 05:27 - 2014-08-16 01:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2014-10-15 05:27 - 2014-08-16 01:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll
2014-10-15 05:27 - 2014-08-16 01:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll
2014-10-15 05:27 - 2014-08-16 01:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll
2014-10-15 05:27 - 2014-08-16 01:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2014-10-15 05:27 - 2014-08-16 01:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll
2014-10-15 05:27 - 2014-08-16 01:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2014-10-15 05:27 - 2014-08-16 01:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll
2014-10-15 05:27 - 2014-08-16 01:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 05:27 - 2014-08-16 01:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll
2014-10-15 05:27 - 2014-08-16 01:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll
2014-10-15 05:27 - 2014-08-16 01:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll
2014-10-15 05:27 - 2014-08-16 01:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 05:27 - 2014-08-16 01:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll
2014-10-15 05:27 - 2014-08-16 01:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll
2014-10-15 05:27 - 2014-08-16 01:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll
2014-10-15 05:27 - 2014-08-16 01:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 05:27 - 2014-08-16 01:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll
2014-10-15 05:27 - 2014-08-16 01:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll
2014-10-15 05:27 - 2014-08-16 01:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-10-15 05:27 - 2014-08-16 01:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe
2014-10-15 05:27 - 2014-08-16 01:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 05:27 - 2014-08-16 01:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-10-15 05:27 - 2014-08-01 00:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml
2014-10-15 05:26 - 2014-10-09 23:16 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-15 05:26 - 2014-10-08 23:09 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-15 05:26 - 2014-09-19 02:24 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-15 05:26 - 2014-09-13 07:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 05:26 - 2014-09-13 06:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 05:26 - 2014-08-29 02:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-10-15 05:26 - 2014-08-29 00:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-10-15 05:26 - 2014-08-29 00:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-10-15 05:14 - 2014-10-15 05:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-10-15 05:11 - 2014-10-26 14:56 - 00001358 _____ () C:\Windows\Tasks\BHWWS.job
2014-10-15 05:11 - 2014-10-15 05:11 - 00004364 _____ () C:\Windows\System32\Tasks\BHWWS
2014-10-15 05:10 - 2014-10-26 14:56 - 00001708 _____ () C:\Windows\Tasks\DTTZBVQB.job
2014-10-15 05:10 - 2014-10-15 05:10 - 00004714 _____ () C:\Windows\System32\Tasks\DTTZBVQB
2014-10-09 21:19 - 2014-10-26 11:52 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Opera Software
2014-10-09 21:19 - 2014-10-26 11:52 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Opera Software
2014-10-09 21:19 - 2014-10-26 11:51 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-10-06 23:55 - 2014-10-06 23:55 - 00000000 ____D () C:\Users\Stephan\Documents\Avatar
2014-10-06 23:54 - 2014-10-06 23:54 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\CyberLink
2014-10-06 23:52 - 2014-10-06 23:52 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Apple Computer
2014-10-06 22:33 - 2014-10-21 16:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-06 22:32 - 2014-10-21 16:03 - 00000000 ____D () C:\ProgramData\Avira
2014-10-06 22:32 - 2014-10-21 16:03 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-06 15:59 - 2014-10-06 15:59 - 00000000 ____D () C:\Users\Mimi\Documents\web
2014-10-06 13:45 - 2014-10-06 13:45 - 00002522 _____ () C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-10-06 04:58 - 2014-10-06 04:58 - 00000000 ____D () C:\Users\Mimi\AppData\Local\CrashDumps
2014-10-01 04:28 - 2014-10-15 05:39 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Apple Computer
2014-09-30 21:46 - 2014-10-26 12:09 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Apple Computer
2014-09-30 21:46 - 2014-10-26 12:06 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Apple Computer
2014-09-30 21:46 - 2014-09-30 21:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-09-30 21:44 - 2012-08-21 12:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-09-30 21:43 - 2014-09-30 21:44 - 00000000 ____D () C:\Program Files\iTunes
2014-09-30 21:43 - 2014-09-30 21:44 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-09-30 21:43 - 2014-09-30 21:43 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-09-30 21:43 - 2014-09-30 21:43 - 00000000 ____D () C:\Program Files\iPod
2014-09-30 21:41 - 2014-09-30 21:41 - 00002535 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2014-09-30 21:41 - 2014-09-30 21:41 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Apple
2014-09-30 21:41 - 2014-09-30 21:41 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-09-30 21:41 - 2014-09-30 21:41 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-09-28 10:14 - 2014-10-02 06:03 - 00000000 ____D () C:\Users\Stephan\Desktop\Flohmarkt1
2014-09-26 10:35 - 2014-09-26 10:36 - 00000000 ____D () C:\Users\Stephan\AppData\Roaming\Mozilla
2014-09-26 10:35 - 2014-09-26 10:36 - 00000000 ____D () C:\Users\Stephan\AppData\Local\Mozilla

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-26 15:02 - 2014-05-07 18:54 - 00800954 _____ () C:\Windows\system32\perfh007.dat
2014-10-26 15:02 - 2014-05-07 18:54 - 00174458 _____ () C:\Windows\system32\perfc007.dat
2014-10-26 15:02 - 2014-03-18 10:53 - 01921090 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-26 15:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2014-10-26 14:58 - 2014-09-19 11:03 - 00000000 ____D () C:\Users\Mimi\Documents\Youcam
2014-10-26 14:55 - 2014-03-18 10:44 - 00411316 _____ () C:\Windows\PFRO.log
2014-10-26 14:55 - 2013-08-22 15:46 - 00033460 _____ () C:\Windows\setupact.log
2014-10-26 14:55 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-26 14:35 - 2014-09-19 10:33 - 02001300 _____ () C:\Windows\WindowsUpdate.log
2014-10-26 12:49 - 2014-09-19 11:11 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2446055026-3567564273-3713566540-1004
2014-10-26 11:47 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-26 11:38 - 2014-09-23 21:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-26 11:15 - 2014-09-19 11:02 - 00000000 ____D () C:\Users\Mimi
2014-10-26 10:51 - 2014-09-19 11:17 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{EBD4C036-B3CB-4392-808C-89DA60C8B663}
2014-10-25 19:27 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache
2014-10-25 13:38 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-10-23 18:58 - 2014-09-19 10:41 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2446055026-3567564273-3713566540-1001
2014-10-23 17:31 - 2014-09-19 10:41 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9EEBF207-CFCB-43C0-B7A7-45B2F06D4561}
2014-10-23 16:34 - 2014-09-23 21:42 - 00000000 ____D () C:\Users\Mimi\Documents\Outlook-Dateien
2014-10-21 22:59 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-10-21 21:59 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-10-21 15:55 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\ELAMBKUP
2014-10-21 15:54 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-10-16 21:47 - 2014-09-19 11:02 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Packages
2014-10-16 17:13 - 2014-09-19 10:38 - 00000000 ____D () C:\Users\Stephan\Documents\Youcam
2014-10-16 17:10 - 2014-09-22 15:40 - 00002169 _____ () C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk
2014-10-16 12:33 - 2014-06-12 12:03 - 00000000 ____D () C:\ProgramData\McAfee
2014-10-16 12:33 - 2014-06-12 12:03 - 00000000 ____D () C:\Program Files (x86)\McAfee
2014-10-16 12:31 - 2014-05-07 09:41 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection
2014-10-16 12:20 - 2014-09-24 19:10 - 00000000 ___HD () C:\Users\Public\Temp
2014-10-16 12:17 - 2013-08-22 15:44 - 00492032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 06:31 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData
2014-10-16 06:31 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\WinStore
2014-10-16 06:31 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\MediaViewer
2014-10-16 06:31 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\FileManager
2014-10-16 06:31 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Camera
2014-10-16 06:23 - 2014-09-20 15:03 - 00000000 ____D () C:\Users\Stephan\Documents\Outlook-Dateien
2014-10-15 06:09 - 2014-09-19 20:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-15 06:04 - 2014-09-21 00:18 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-15 05:47 - 2014-09-21 00:18 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-15 05:45 - 2014-09-22 12:32 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-14 18:41 - 2014-06-12 11:39 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-12 18:05 - 2014-09-22 11:53 - 00000000 ____D () C:\Users\Stephan\Desktop\Rechnungen Möbeltaxi
2014-10-11 09:06 - 2014-09-19 10:35 - 00000000 ____D () C:\Users\Stephan
2014-10-09 22:17 - 2014-09-19 20:34 - 00000000 ____D () C:\beide
2014-10-06 23:54 - 2014-06-12 12:02 - 00000000 ____D () C:\Users\Public\CyberLink
2014-10-06 23:53 - 2014-09-19 10:38 - 00000000 ____D () C:\Users\Stephan\AppData\Local\CyberLink
2014-10-06 23:53 - 2014-06-12 11:51 - 00000000 ____D () C:\ProgramData\CyberLink
2014-10-06 23:53 - 2014-05-07 18:34 - 00000000 ___HD () C:\HP
2014-09-30 21:41 - 2014-06-12 11:43 - 00000000 ____D () C:\ProgramData\Apple
2014-09-29 23:45 - 2014-09-22 12:39 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-29 23:45 - 2014-09-22 12:39 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-26 18:37 - 2014-03-18 10:38 - 00000000 ____D () C:\Program Files\Windows Journal
2014-09-26 18:37 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2014-09-26 18:37 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-26 18:37 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-26 18:37 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\setup
2014-09-26 18:37 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\setup
2014-09-26 18:37 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\system32\oobe
2014-09-26 05:53 - 2014-09-24 05:41 - 00000000 ____D () C:\Users\Stephan\AppData\Local\CrashDumps

Some content of TEMP:
====================
C:\Users\Mimi\AppData\Local\Temp\avgnt.exe
C:\Users\Mimi\AppData\Local\Temp\Quarantine.exe
C:\Users\Mimi\AppData\Local\Temp\sqlite3.dll
C:\Users\Stephan\AppData\Local\Temp\AdhL1.exe
C:\Users\Stephan\AppData\Local\Temp\avgnt.exe
C:\Users\Stephan\AppData\Local\Temp\BackupSetup.exe
C:\Users\Stephan\AppData\Local\Temp\EdSD9.dll
C:\Users\Stephan\AppData\Local\Temp\EdSD9.exe
C:\Users\Stephan\AppData\Local\Temp\jzdp9.dll
C:\Users\Stephan\AppData\Local\Temp\jzdp9.exe
C:\Users\Stephan\AppData\Local\Temp\OnlineBackup.exe
C:\Users\Stephan\AppData\Local\Temp\setup_337.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-20 23:01

==================== End Of Log ============================
--- --- ---

--- --- ---
Geändert von Manjetschka (26.10.2014 um 11:06 Uhr)

Alt 27.10.2014, 09:44   #8
schrauber
/// the machine
/// TB-Ausbilder
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

ads by cinema-plus 1.7c und weitere Seuchen


Über Chip lädt man auch keine Software mehr....

Ich brauch bitte noch ne frische Addition.txt.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 28.10.2014, 07:58   #9
Manjetschka
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

ads by cinema-plus 1.7c und weitere Seuchen


Aha, ich dachte chip wäre seriös. Wo läd man denn heute? Anbei die frische Addition

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-10-2014
Ran by Mimi at 2014-10-27 16:06:54
Running from C:\Users\Mimi\Desktop\Security
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.4.144 - Adobe Systems, Inc.)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 6.223.215.5 - Broadcom Corporation)
Broadcom Bluetooth Drivers (HKLM\...\{0A1B4690-E176-4533-8058-939480AEE1D0}) (Version: 12.0.0.9130 - Broadcom Corporation)
Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden
Building the Great Wall of China Collector's Edition (x32 Version: 3.0.2.48 - WildTangent) Hidden
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.) Hidden
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.) Hidden
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.) Hidden
Crazy Chicken Soccer (x32 Version: 2.2.0.110 - WildTangent) Hidden
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.6.3728 - CyberLink Corp.)
Cyberlink PhotoDirector (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.4.4824 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.6.3821 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.6.3604 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3.3709 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.3.3907 - CyberLink Corp.)
DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Energy Star (HKLM\...\{465CA2B6-98AF-4E77-BE22-A908C34BB9EC}) (Version: 1.0.9 - Hewlett-Packard Company)
Evernote v. 5.2 (HKLM-x32\...\{412F6426-A3C7-11E3-8A71-00163E98E7D6}) (Version: 5.2.0.2951 - Evernote Corp.)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP 3D DriveGuard (HKLM-x32\...\{F90A86C9-7779-47DD-AC06-8EE832C55F55}) (Version: 6.0.18.1 - Hewlett-Packard Company)
HP CoolSense (HKLM-x32\...\{E2C8D0C2-1C97-4C05-939A-5B13A0FE655C}) (Version: 2.20.31 - Hewlett-Packard Company)
HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{082B1425-0F24-43FA-9B64-E8F617B0AD3B}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Postscript Converter (Version: 4.5.12202 - Hewlett-Packard) Hidden
HP Recovery Manager (x32 Version: 1.16.1420 - Hewlett-Packard) Hidden
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7493.4758 - Hewlett-Packard)
HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.11 - Hewlett-Packard)
HP SimplePass (Version: 8.01.11 - Hewlett-Packard) Hidden
HP Support Assistant (HKLM-x32\...\{8C696B4B-6AB1-44BC-9416-96EAC474CABE}) (Version: 7.5.2.12 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\...\{DEF23826-DB71-4654-BC00-D5D6C20802EA}) (Version: 1.1.4 - Hewlett-Packard Company)
HP Utility Center (HKLM\...\{36F80C5F-DC0D-4DF4-AF09-DC1867F0EB0A}) (Version: 2.4.4 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)
Inst5675 (Version: 8.01.11 - Softex Inc.) Hidden
Inst5676 (Version: 8.01.11 - Softex Inc.) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3408 - Intel Corporation)
Intel(R) Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.0.0.1002 - Intel Corporation)
Intel(R) Smart Connect Technology (HKLM\...\{8B4EA042-9E21-46FB-8286-225F4D51CC52}) (Version: 4.2.41.2710 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)
Intel(R) Trusted Execution Engine (Version: 1.1.1.1 - Intel Corporation) Hidden
Intel(R) Trusted Execution Engine Driver (Version: 1.0.0.1064 - Intel Corporation) Hidden
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Mozilla Firefox 33.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0.1 (x86 de)) (Version: 33.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0.1 - Mozilla)
Opera Stable 25.0.1614.63 (HKLM-x32\...\Opera 25.0.1614.63) (Version: 25.0.1614.63 - Opera Software ASA)
Plants vs. Zombies - Game of the Year (x32 Version: 3.0.2.51 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Ranch Rush 2 - Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.273.40 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.24.1218.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7231 - Realtek Semiconductor Corp.)
Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 18.1.5.2 - Synaptics Incorporated)
TeamViewer 9 Host (HKLM-x32\...\TeamViewer 9 Host) (Version: 9.0.32494 - TeamViewer)
Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
Virtual Families (x32 Version: 2.2.0.98 - WildTangent) Hidden
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
WildTangent Games App für HP (x32 Version: 4.0.11.2 - WildTangent) Hidden
WildTangent-Spiele (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
Youda Jewel Shop (x32 Version: 3.0.2.51 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

21-10-2014 00:14:05 Installed SpyHunter
26-10-2014 11:04:29 Installed Safari

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {03525191-2818-4456-888D-3A7192E2BACE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {17C72762-734C-4B70-AAC2-5D74CC2519EB} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {21199D4C-F9E7-4A63-8AFD-C469861365D8} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {435A3907-8132-40E2-8BA5-142799C77218} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {4757E115-2C2F-4AE2-BB63-860AD2712FC3} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {537E8FD2-D489-4A80-B2AB-0050A0FBD196} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [2014-03-07] (CyberLink Corp.)
Task: {56BD98E5-BC44-41BC-81FE-3287F5B2237E} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {57775F9D-AFB7-489B-B1FD-3FF1E8656E51} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [2013-11-01] (Hewlett-Packard Development Company, L.P.)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {7579AC14-35E3-4A2F-B87F-0F95DDE6DB2F} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-10-15] (Microsoft Corporation)
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {98292BAF-42C3-4FC1-9056-7EB1EE3B3C57} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {9BF7FFD1-1970-4AB6-8C7C-3D1704385292} - System32\Tasks\DTTZBVQB => C:\Users\Stephan\AppData\Roaming\DTTZBVQB.exe <==== ATTENTION
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A7D760E0-5FF2-4493-BE8A-D04147F5137C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
Task: {C111F0E1-07DD-446E-B7CC-1FED8676AAF5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-12-18] (Hewlett-Packard)
Task: {CBDA51B5-18F3-4C3F-BBAD-09E7E42FDD0E} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-03-18] (Microsoft Corporation)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D352DA66-6B83-46D8-9915-8E7B856C5978} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E320C1A2-C49D-4B28-8CE2-B591B1D3CC3F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company)
Task: {E611AC48-C78A-49B8-BD92-2BBFD6609FCA} - System32\Tasks\BHWWS => C:\Users\Stephan\AppData\Roaming\BHWWS.exe <==== ATTENTION
Task: {E6BC8682-1BE0-47F6-8A8B-AB9F8FEC3788} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {ED51613F-CB07-440E-A088-C345D864981A} - System32\Tasks\Opera scheduled Autoupdate 1414320714 => C:\Program Files (x86)\Opera\launcher.exe [2014-10-23] (Opera Software)
Task: {F0B98C9F-6959-4722-99E9-087B230FC7AF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-12-18] (Hewlett-Packard)
Task: C:\Windows\Tasks\BHWWS.job => C:\Users\Stephan\AppData\Roaming\BHWWS.exe <==== ATTENTION
Task: C:\Windows\Tasks\DTTZBVQB.job => C:\Users\Stephan\AppData\Roaming\DTTZBVQB.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2014-03-28 12:31 - 2014-03-28 12:31 - 02110464 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll
2014-03-28 12:27 - 2014-03-28 12:27 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll
2014-03-28 12:27 - 2014-03-28 12:27 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll
2014-03-28 12:27 - 2014-03-28 12:27 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll
2014-03-28 12:48 - 2014-03-28 12:48 - 00367504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll
2014-03-28 12:48 - 2014-03-28 12:48 - 00712080 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll
2013-12-04 07:44 - 2013-12-04 07:44 - 00200168 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
2013-12-04 07:44 - 2013-12-04 07:44 - 00054760 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll
2013-12-04 07:44 - 2013-12-04 07:44 - 00034792 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTNetMon.dll
2013-09-04 23:17 - 2013-09-04 23:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-03-28 12:36 - 2014-03-28 12:36 - 00065024 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
2014-10-26 11:51 - 2014-10-15 10:33 - 00499832 _____ () C:\Program Files (x86)\Opera\25.0.1614.50\opera_crashreporter.exe
2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-07-31 11:16 - 2014-07-31 11:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-10-21 19:25 - 2014-05-13 11:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-10-21 19:25 - 2014-05-13 11:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-10-21 19:25 - 2014-05-13 11:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-10-21 19:25 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-10-21 19:25 - 2012-04-03 16:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-09-04 23:14 - 2013-09-04 23:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2014-10-26 11:51 - 2014-10-15 10:33 - 00156792 _____ () C:\Program Files (x86)\Opera\25.0.1614.50\message_center_win8.dll
2014-10-26 11:51 - 2014-10-15 10:33 - 01310328 _____ () C:\Program Files (x86)\Opera\25.0.1614.50\libglesv2.dll
2014-10-26 11:51 - 2014-10-15 10:33 - 00219256 _____ () C:\Program Files (x86)\Opera\25.0.1614.50\libegl.dll
2014-10-26 11:51 - 2014-10-15 10:33 - 09218680 _____ () C:\Program Files (x86)\Opera\25.0.1614.50\pdf.dll
2014-10-26 11:51 - 2014-10-15 10:33 - 00991864 _____ () C:\Program Files (x86)\Opera\25.0.1614.50\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2446055026-3567564273-3713566540-500 - Administrator - Disabled)
Gast (S-1-5-21-2446055026-3567564273-3713566540-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2446055026-3567564273-3713566540-1003 - Limited - Enabled)
Mimi (S-1-5-21-2446055026-3567564273-3713566540-1004 - Administrator - Enabled) => C:\Users\Mimi
Stephan (S-1-5-21-2446055026-3567564273-3713566540-1001 - Administrator - Enabled) => C:\Users\Stephan

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/27/2014 03:51:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 88583719

Error: (10/27/2014 03:51:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 88583719

Error: (10/27/2014 03:51:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/26/2014 00:30:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 14922

Error: (10/26/2014 00:30:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 14922

Error: (10/26/2014 00:30:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/26/2014 00:29:47 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: Steppo)
Description: Das Paket „Microsoft.Reader_6.3.9654.17044_x64__8wekyb3d8bbwe+Microsoft.Reader“ wurde beendet, da das Anhalten zu lange dauerte.

Error: (10/26/2014 11:35:22 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 119672

Error: (10/26/2014 11:35:22 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 119672

Error: (10/26/2014 11:35:22 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (10/26/2014 00:37:11 PM) (Source: ACPI) (EventID: 13) (User: )
Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.

Error: (10/26/2014 00:19:46 PM) (Source: ACPI) (EventID: 13) (User: )
Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.

Error: (10/26/2014 00:19:41 PM) (Source: ACPI) (EventID: 13) (User: )
Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.

Error: (10/26/2014 00:19:36 PM) (Source: ACPI) (EventID: 13) (User: )
Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.

Error: (10/26/2014 11:35:24 AM) (Source: ACPI) (EventID: 13) (User: )
Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.

Error: (10/26/2014 10:57:27 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎26.‎10.‎2014 um 10:55:27 unerwartet heruntergefahren.

Error: (10/26/2014 10:48:02 AM) (Source: ACPI) (EventID: 13) (User: )
Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.

Error: (10/25/2014 07:21:30 PM) (Source: DCOM) (EventID: 10010) (User: Steppo)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (10/25/2014 07:20:59 PM) (Source: DCOM) (EventID: 10010) (User: Steppo)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (10/25/2014 01:38:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Intel(R) Smart Connect Technology Agent" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%109


Microsoft Office Sessions:
=========================
Error: (10/27/2014 03:51:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 88583719

Error: (10/27/2014 03:51:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 88583719

Error: (10/27/2014 03:51:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/26/2014 00:30:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 14922

Error: (10/26/2014 00:30:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 14922

Error: (10/26/2014 00:30:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/26/2014 00:29:47 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: Steppo)
Description: Microsoft.Reader_6.3.9654.17044_x64__8wekyb3d8bbwe+Microsoft.Reader

Error: (10/26/2014 11:35:22 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 119672

Error: (10/26/2014 11:35:22 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 119672

Error: (10/26/2014 11:35:22 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU N3530 @ 2.16GHz
Percentage of memory in use: 50%
Total physical RAM: 3988.09 MB
Available physical RAM: 1984.48 MB
Total Pagefile: 4692.09 MB
Available Pagefile: 1999.73 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:678.02 GB) (Free:573.96 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:19.6 GB) (Free:1.9 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 9AF1B1A5)

Partition: GPT Partition Type.

==================== End Of Log ============================
Code:
ATTFilter
Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <Windows>
C:\swapfile.sys
  [WARNUNG]   Die Datei konnte nicht geöffnet werden!
C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\cb28a990-316d-488c-ad50-248dd0f8de58-2.exe.vir
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn
C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\cb28a990-316d-488c-ad50-248dd0f8de58-5.exe.vir
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn
C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\CinPl-2.5cV14.10-bho64.dll.vir
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn
C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\CinPl-2.5cV14.10-codedownloader.exe.vir
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn
Beginne mit der Suche in 'D:\' <RECOVERY>

Beginne mit der Desinfektion:
C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\CinPl-2.5cV14.10-codedownloader.exe.vir
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5295750c.qua' verschoben!
C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\CinPl-2.5cV14.10-bho64.dll.vir
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4a025aa4.qua' verschoben!
C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\cb28a990-316d-488c-ad50-248dd0f8de58-5.exe.vir
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '18610046.qua' verschoben!
C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\cb28a990-316d-488c-ad50-248dd0f8de58-2.exe.vir
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/CrossRider.dn
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7e564f85.qua' verschoben!
Code:
ATTFilter
C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\1293297481.mxaddon.vir	JS/Toolbar.Crossrider.D evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Program Files (x86)\CinPl-2.5cV14.10\utils.exe.vir	Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\7ki9jzgc.default\Extensions\3c8f3083-413b-4aa6-ad29-fb93d8982e80@gmail.com\extensionData\plugins\91.js.vir	JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\Stephan\AppData\Local\Temp\VOPackage.exe.vir	Win32/VOPackage.AD evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\Stephan\AppData\Roaming\Mozilla\Firefox\Profiles\nbpps1a8.default\Extensions\3c8f3083-413b-4aa6-ad29-fb93d8982e80@gmail.com\extensionData\plugins\91.js.vir	JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Windows\score.exe.vir	Variante von Win32/Agent.WGA Trojaner	Gesäubert durch Löschen - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir	Variante von Win64/Systweak.A evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\{6eaeb8af-e4d9-4df5-b9d7-815f2928cdf7}Gw64.sys.vir	Variante von Win64/BrowseFox.AU evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\beide\str\Programme\Application Updater\ApplicationUpdater.exe	Variante von Win32/Toolbar.Widgi.A evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\beide\str\Programme\Gemeinsame Dateien\Spigot\Search Settings\SearchSettings.exe	Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\beide\str\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll	Win32/Toolbar.Widgi evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\beide\str\Programme\pdfforge Toolbar\WidgiHelper.exe	Win32/Toolbar.Widgi evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\beide\str\Programme\pdfforge Toolbar\IE\4.3\pdfforgeToolbarIE.dll	Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\AdhL1.exe	Variante von Win32/Adware.AddLyrics.CL Anwendung	Gesäubert durch Löschen - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\ICReinstall_nstDA09.tmp	Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\nsc620.tmp	Variante von Win32/InstallCore.PL evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\nsp3BDD.tmp	Variante von Win32/InstallCore.PO evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\nsrEB05.tmp	Variante von Win32/InstallCore.PO evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\nstDA09.tmp	Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\6A80tmp\cloud_backup_setup.exe	Win32/MyPCBackup.A evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\6A82tmp\optimizerpro.exe	Mehrere Bedrohungen	Gesäubert durch Löschen - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\is-4234E.tmp\package_plushd_installer_multilang.exe	Win32/AdWare.EoRezo.AW Anwendung	Gesäubert durch Löschen - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\is-4234E.tmp\package_shoppinghelper_installer_multilang.exe	Win32/AdWare.EoRezo.AW Anwendung	Gesäubert durch Löschen - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\is-H8NDO.tmp\gentlemjmbot_img.exe	Win32/AdWare.EoRezo.AW Anwendung	Gesäubert durch Löschen - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\is45637729\127855424_stp\Generic_vo.exe	Win32/VOPackage.X evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\is45637729\165431062_stp\Generic_vo.exe	Win32/VOPackage.X evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\is45637729\165431349_stp\rcpsetup_adppi12_adppi12.exe	Win32/Systweak.D evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\is45637729\3647467_stp\Generic_vo.exe	Win32/VOPackage.X evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\is45637729\3647825_stp\rcpsetup_adppi12_adppi12.exe	Win32/Systweak.D evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\is667172802\0E5B3EE8_stp\rcpsetup_adppi12_adppi12.exe	Win32/Systweak.D evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert
C:\Users\Stephan\AppData\Local\Temp\nsgA3A9.tmp\nsManeshWeb.dll	Win32/InstallMonetizer.BC evtl. unerwünschte Anwendung	gelöscht - in Quarantäne kopiert

Alt 28.10.2014, 19:21   #10
schrauber
/// the machine
/// TB-Ausbilder
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

ads by cinema-plus 1.7c und weitere Seuchen


Mit Revo alle Browser ausser IE runter, Reste raus, neu installieren.

Setze folgendermassen den Internet Explorer zurück:
  • Öffne den Internet Explorer und gehe zu Extras -> Internetoptionen.
  • Klicke in der Registerkarte Erweitert unter "Internet Explorer-Einstellungen zurücksetzen" auf Zurücksetzen...
  • Klicke im Dialogfeld "Internet Explorer-Einstellungen zurücksetzen" zum Bestätigen auf Zurücksetzen.
(Hier findest du die bebilderte Anleitung.)



Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 28.10.2014, 20:15   #11
Manjetschka
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

ads by cinema-plus 1.7c und weitere Seuchen


? Was meinst du mit Reste raus & neu installieren? Revo hat nur Opera erkannt und lauter systemseitige Programme (HP, apple, adobe, microsoft visual etc.) die kann ich doch nicht einfach rauslöschen?

Alt 29.10.2014, 18:44   #12
schrauber
/// the machine
/// TB-Ausbilder
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

ads by cinema-plus 1.7c und weitere Seuchen


nein, ich rede nur von den Browsern. Wenn Du Opera mit Revo deinstallierst wird Revo auch anbieten die Reste zu entfernen von Opera, das sollst du machen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 01.11.2014, 20:38   #13
Manjetschka
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

ads by cinema-plus 1.7c und weitere Seuchen


Hey Schrauber, habe das Laptop jetzt auf Werkseinstellung zurückgesetzt. Danke für den Support & happy WE

Alt 02.11.2014, 13:36   #14
schrauber
/// the machine
/// TB-Ausbilder
 
ads by cinema-plus 1.7c und weitere Seuchen - Standard

ads by cinema-plus 1.7c und weitere Seuchen


ok.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu ads by cinema-plus 1.7c und weitere Seuchen
adware/crossrider.dn, js/toolbar.crossrider.b, js/toolbar.crossrider.d, opera browser, spyhunter, spyhunter entfernen, win32/adware.addlyrics.cl, win32/adware.eorezo.aw, win32/agent.wga, win32/installcore.pk, win32/installcore.pl, win32/installcore.po, win32/installmonetizer.bc, win32/mypcbackup.a, win32/packed.vmdetector.i, win32/systweak.d, win32/toolbar.widgi, win32/toolbar.widgi.a, win32/vopackage.ad, win32/vopackage.x, win64/browsefox.au, win64/systweak.a


« Windows 7 erhalte ständig spammails auf outlook und internetverbindung läuft langsamer | Omiga plus "gelöscht" und malwarebytes Anti-malware startet nicht. »


Ähnliche Themen: ads by cinema-plus 1.7c und weitere Seuchen


  1. Ads by Cinema Plus 3.4V12.11 entfernen
    Anleitungen, FAQs & Links - 14.11.2015 (2)
  2. Ads By Cinema Plus3.4V12.11 entfernen
    Anleitungen, FAQs & Links - 14.11.2015 (2)
  3. Ads By Lights Cinema 1.6beta entfernen
    Anleitungen, FAQs & Links - 09.11.2015 (2)
  4. Ads By Cinema Video Pro 1.6V entfernen
    Anleitungen, FAQs & Links - 08.11.2015 (2)
  5. Ads By Plus HD Cinema 3.1cV entfernen
    Anleitungen, FAQs & Links - 08.11.2015 (2)
  6. Ads By Cinema PlusV27.10 entfernen
    Anleitungen, FAQs & Links - 24.10.2015 (2)
  7. REWINUP Cinema entfernen
    Anleitungen, FAQs & Links - 19.10.2015 (2)
  8. Ads By Cinema Video Plus 2.1c entfernen
    Anleitungen, FAQs & Links - 14.09.2015 (2)
  9. Ads By Cinema Video Plus 2.1c entfernen
    Anleitungen, FAQs & Links - 13.09.2015 (2)
  10. Ads by Cinema Video entfernen
    Anleitungen, FAQs & Links - 06.08.2015 (2)
  11. Mac Os 10.10.1 Firefox 34.0 werde Cinema ploos nicht los, Verdacht auf weitere Malware
    Alles rund um Mac OSX & Linux - 12.12.2014 (13)
  12. Cinema Go Pro entfernen
    Anleitungen, FAQs & Links - 01.12.2014 (2)
  13. Cinema-Plus-2.3c entfernen
    Anleitungen, FAQs & Links - 31.08.2014 (2)
  14. I-Cinema entfernen
    Anleitungen, FAQs & Links - 08.08.2014 (2)
  15. Cinema-Plus-1.2c entfernen
    Anleitungen, FAQs & Links - 25.07.2014 (2)
  16. WAREZOV- kann man noch mehr seuchen haben als ich? bitte ma helfen:)
    Log-Analyse und Auswertung - 20.03.2007 (9)
  17. 88 Viren, Würmer, Zecken, Bakterien, Salmonellen, Seuchen etc. Hiiiiiiiiiiilfe
    Log-Analyse und Auswertung - 29.01.2006 (26)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema ads by cinema-plus 1.7c und weitere Seuchen - Tachschön in die Runde, beim surfen im Internet öffnen sich hunderte von Werbefenstern der unterschiedlichsten Anbieter und zeitweise wird vollkommen ohne Zusammenhang eine Audio über Loch Ness eingespielt?! Das Laufwerk - ads by cinema-plus 1.7c und weitere Seuchen...
Archiv
Du betrachtest: ads by cinema-plus 1.7c und weitere Seuchen auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130