Laptop Thosiba Windows 7/64 bit wurde gehackt!
Seit 3-4 Wochen bemerkte ich Veränderungen auf meinem Laptop.Auf dem Laptop war eine
virtuelle Fritzbox installiert.Dann bemerkte ich als ich sie deaktivierte,daß bei xp-Antispy mehrmals Regedit verstellt war,jetzt auch wieder,läßt sich auch nicht schalten.Virenscanner fanden 9 Bedrohungen,Avast-Quarantäne!Dann war Avast deaktiviert,Neuer Suchlauf-Keine Bedrohungen.Emsisoft Antimalware fand 2 Bedrohungen-Quarantäne.Das ist wie bei Hase und Igel.Jetzt wollte ich ein Neues Fenster bei Firefox 33 öffnen,da kommt als Adresse
chrome://unitedtb/content/newtab/newtab-page.xhtml.Ich hatte Firefox schon zurückgesetzt.Jetzt das gleiche Spiel chrome://unitedtb/content/newtab/newtab-page.xhtml.
Ich habe seit 15 Jahren einen Computer und mir Wissen angeeignet,aber jetzt brauche ich Hilfe!
Ich bin auch nicht mehr der Jüngste.Ich schätze Mal,daß ich von oberster Stelle ausspioniert werde,weil ich Wert auf größte Sicherheit im Internet gelegt habe.Ich hatte Cyperghost 5,
Zenmate Verschlüsselung im Firefox.Das alles hatte ich installiert um sicheres Online Banking
zu tätigen.Firewall G Data konnte übrigens nicht richtig installiert werden.Jetzige Firewall-Online Armorfree.Bedrohungen wurden von mir blockiert!

Hallo hel47



Mein Name ist Timo und ich werde Dir bei deinem Problem behilflich sein.

• Bitte arbeite alle Schritte der Reihe nach ab.
• Hier findest du die Anleitung für Hilfesuchende
• Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
• Nur Scans durchführen zu denen Du von einem Helfer aufgefordert wirst.
• Bitte kein Crossposting ( posten in mehreren Foren).
• Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
• Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
• Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist immer der sicherste Weg.

Wir "arbeiten" hier alle freiwillig und in unserer Freizeit *hust*. Daher kann es bei Antworten zu Verzögerungen kommen.
Solltest du innerhalb 48 Std keine Antwort von mir erhalten, dann schreib mit eine PM
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis ich oder jemand vom Team sagt, dass Du clean bist.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2014
Ran by Helmut (administrator) on HELMUT-TOSH on 28-10-2014 21:23:02
Running from C:\Users\Helmut\Desktop
Loaded Profile: Helmut (Available profiles: Helmut)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\ASCService.exe
(IOBit) C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\ASCAvSvc.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Emsisoft GmbH) C:\Program Files (x86)\Online Armor\oacat.exe
(Emsisoft GmbH) C:\Program Files (x86)\Online Armor\oasrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Windows\System32\GFNEXSrv.exe
() C:\Program Files (x86)\Ashampoo\Ashampoo Magical Defrag 3\defragservice.exe
(Foxit Corporation) C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
() C:\Program Files (x86)\Ashampoo\Ashampoo Magical Defrag 3\defragmonitorservice.exe
() C:\Program Files (x86)\Ashampoo\Ashampoo Magical Defrag 3\defragactivitymonitor.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Emsisoft GmbH) C:\Program Files (x86)\Online Armor\oaui.exe
(TOSHIBA) C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe
(Emsisoft GmbH) C:\Program Files (x86)\Online Armor\oahlp.exe
(Tobit.Software) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe
(J3S GmbH) C:\Program Files (x86)\COMPUTER BILD Account-Alarm\COMPUTER BILD Account-Alarm.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\ASCTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe
() C:\Program Files (x86)\Ashampoo\Ashampoo Magical Defrag 3\defragtaskbar.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
(IObit) C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
() C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\RealTimeProtector.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngtool.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeSrvUseMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeBtMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeSrvProvider.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
() C:\Program Files\AVAST Software\Avast\ng\mftutil.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13667032 2014-04-24] (Realtek Semiconductor)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2165120 2012-03-22] (SRS Labs, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2866960 2011-12-19] (Synaptics Incorporated)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-09-23] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [989056 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1548208 2011-11-24] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-11-26] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [150992 2012-05-10] (Toshiba Europe GmbH)
HKLM\...\Run: [@OnlineArmor GUI] => C:\Program Files (x86)\Online Armor\oaui.exe [7558464 2013-10-11] (Emsisoft GmbH)
HKLM\...\Run: [MSC] => [X]
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-01-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-07-18] (Intel Corporation)
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-12] (TOSHIBA Corporation)
HKLM-x32\...\Run: [DefragTaskBar] => C:\Program Files (x86)\Ashampoo\Ashampoo Magical Defrag 3\defragtaskbar.exe [927072 2009-12-16] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [440632 2014-08-29] (Malwarebytes Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5223016 2014-10-22] (AVAST Software)
HKLM\...\Policies\Explorer: [NoSecurity Tab] 1
HKU\S-1-5-19\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-20\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\Run: [RfxSrvTray] => C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\Run: [COMPUTER BILD Account-Alarm] => C:\Program Files (x86)\COMPUTER BILD Account-Alarm\COMPUTER BILD Account-Alarm.exe [2058752 2014-08-07] (J3S GmbH)
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [784392 2014-05-29] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\Run: [Advanced SystemCare Ultimate] => C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\ASCTray.exe [2562368 2013-12-02] (IObit)
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\Run: [PrivacyOptimizer] => C:\Program Files\Badosoft\Privacy Optimizer\PrivacyOptimizer.exe [10640056 2014-01-08] (Badosoft)
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\Policies\Explorer: [NoRecentDocsNetHood] 1
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\Policies\Explorer: [NoRecentDocsHistory] 1
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\Policies\Explorer: [NoRecentDocsMenu] 1
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\Policies\Explorer: [NoSecurityTab] 1
HKU\S-1-5-21-3457080408-1642351141-37163438-1000\...\MountPoints2: {894569e8-ac59-11e1-9076-806e6f6e6963} - D:\zdata\cobi.exe
HKU\S-1-5-18\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-18\...\Run: [Advanced SystemCare 7] => "C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe" /Auto
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng1.exe (TOSHIBA CORPORATION.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Toshiba Places Icon Utility.lnk
ShortcutTarget: Toshiba Places Icon Utility.lnk -> C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe (Toshiba)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: 
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com/?fr=hp-avast&type=avastbcl
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://de.yahoo.com/?fr=hp-avast&type=avastbcl
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com/?fr=hp-avast&type=avastbcl
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = https://de.yahoo.com/?fr=hp-avast&type=avastbcl
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - {5A6C5665-1834-40E5-8C0E-E120683B42B8} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TEUA;
SearchScopes: HKCU - DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKCU - {474EB444-5809-4E5F-A5C5-6D53CB97E798} URL = hxxp://search.findwide.com/serp?guid={164985FE-982A-470A-8E47-43FE52E8A846}&action=default_search&k={searchTerms}
SearchScopes: HKCU - {62C1D4AA-B385-4D65-AB3E-D8D78906BC3D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo
SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: CBAbzockschutz.InitToolbarBHO -> {2e250b90-0e7a-42a3-9d65-e39f9f227fa4} -> C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Advanced SystemCare Browser Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
Toolbar: HKLM-x32 - COMPUTERBILD-Abzockschutz - {353e2a48-6254-4bd3-88f4-3b51a0ca7870} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{5ACA316D-A103-4B5E-9B41-2C7672FDE354}: [NameServer] 156.154.70.25,156.154.71.25
Tcpip\..\Interfaces\{B099EE2C-A059-423B-A5F3-A2AED593E8D0}: [NameServer] 156.154.70.25,156.154.71.25

FireFox:
========
FF ProfilePath: C:\Users\Helmut\AppData\Roaming\Mozilla\Firefox\Profiles\uvbg1m54.default-1414511244281
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_189.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\google-deutschland.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NoScript - C:\Users\Helmut\AppData\Roaming\Mozilla\Firefox\Profiles\uvbg1m54.default-1414511244281\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-10-28]
FF Extension: Adblock Plus - C:\Users\Helmut\AppData\Roaming\Mozilla\Firefox\Profiles\uvbg1m54.default-1414511244281\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-10-28]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-10-22]
FF Extension: No Name - wrc@avast.com [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Helmut\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Helmut\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-14]
CHR Extension: (Google Drive) - C:\Users\Helmut\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-14]
CHR Extension: (YouTube) - C:\Users\Helmut\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-14]
CHR Extension: (Google Search) - C:\Users\Helmut\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-14]
CHR Extension: (RealDownloader) - C:\Users\Helmut\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-01-27]
CHR Extension: (No Name) - C:\Users\Helmut\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2014-03-19]
CHR Extension: (Google Wallet) - C:\Users\Helmut\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-14]
CHR Extension: (Gmail) - C:\Users\Helmut\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-14]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2014-10-22]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-10-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4816568 2014-10-13] (Emsisoft GmbH)
R2 AdvancedSystemCareService7; C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\ASCService.exe [886592 2013-11-15] (IObit)
R2 ASCAntivirusSrv; C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\ascavsvc.exe [646976 2013-11-28] (IOBit)
R2 Ashampoo Defrag Service; C:\Program Files (x86)\Ashampoo\Ashampoo Magical Defrag 3\defragservice.exe [890208 2009-12-16] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-10-22] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-10-22] (Avast Software)
R2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [242216 2014-06-17] (Foxit Corporation)
R2 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-10] ()
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-16] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2283296 2014-10-15] (IObit)
R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [441144 2014-08-29] (Malwarebytes Corporation)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R2 OAcat; C:\Program Files (x86)\Online Armor\OAcat.exe [584864 2013-10-11] (Emsisoft GmbH)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [289496 2014-01-17] (Realtek Semiconductor)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [174088 2014-05-29] (Sandboxie Holdings, LLC)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 SvcOnlineArmor; C:\Program Files (x86)\Online Armor\oasrv.exe [4457688 2013-10-11] (Emsisoft GmbH)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
S2 EaseUS Agent; No ImagePath
S2 Intel(R) Capability Licensing Service Interface; No ImagePath

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [71472 2014-05-12] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [36096 2013-05-21] (Advanced Micro Devices, Inc.)
S1 AntiLog32; No ImagePath
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-10-22] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [82768 2014-10-22] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-10-22] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-10-22] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1049920 2014-10-22] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-10-22] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-10-22] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-10-22] ()
S3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-04] (Emsisoft GmbH)
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [63000 2014-08-30] ()
R0 EUBAKUP; C:\Windows\System32\Drivers\EUBAKUP.sys [61000 2014-08-13] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [48200 2014-08-13] () [File not signed]
R1 EUDSKACS; C:\Windows\System32\Drivers\EUDSKACS.sys [18504 2014-08-13] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R1 EUFDDISK; C:\windows\system32\drivers\EuFdDisk.sys [189000 2014-08-13] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
S3 FileMonitor; No ImagePath
R1 HBtnKey; C:\Windows\System32\DRIVERS\wstbtndb.sys [9856 2007-09-14] (Lenovo)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [7717984 2014-04-30] (Kaspersky Lab ZAO)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [92768 2014-04-30] (Kaspersky Lab ZAO)
S3 leawo_vad; C:\Windows\System32\drivers\leawo_vad.sys [33048 2013-05-21] (Shenzhen Moyea Software)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [100312 2014-05-24] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R1 OADevice; C:\windows\SysWow64\Drivers\OADriver.sys [64720 2013-10-11] ()
R1 oahlpXX; C:\windows\syswow64\drivers\oahlp64.sys [62008 2013-10-11] ()
R1 OAmon; C:\windows\SysWOW64\Drivers\OAmon.sys [52360 2013-10-11] (Emsisoft)
R3 OAnet; C:\Windows\System32\DRIVERS\oanet.sys [35368 2013-10-11] (Emsisoft)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 RegFilter; No ImagePath
R3 RtkBtFilter; C:\Windows\System32\DRIVERS\RtkBtfilter.sys [555736 2014-03-17] (Realtek Semiconductor Corporation)
S3 RTL8192Ce; C:\Windows\System32\DRIVERS\rtwlane.sys [3073752 2014-03-17] (Realtek Semiconductor Corporation                           )
R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [3073752 2014-03-17] (Realtek Semiconductor Corporation                           )
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [185352 2014-05-29] (Sandboxie Holdings, LLC)
S3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [34544 2013-09-04] (Synaptics Incorporated)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [867824 2013-10-20] () [File not signed]
S3 UrlFilter; No ImagePath
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [270728 2014-10-22] (Avast Software)
U4 CmdAgent; No ImagePath
U3 DfSdkS; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-28 21:23 - 2014-10-28 21:24 - 00028975 _____ () C:\Users\Helmut\Desktop\FRST.txt
2014-10-28 21:22 - 2014-10-28 21:23 - 00000000 ____D () C:\FRST
2014-10-28 18:02 - 2014-10-28 21:15 - 00000112 _____ () C:\windows\setupact.log
2014-10-28 18:02 - 2014-10-28 18:02 - 00000000 _____ () C:\windows\setuperr.log
2014-10-28 18:01 - 2014-10-28 18:01 - 00040828 _____ () C:\windows\PFRO.log
2014-10-28 18:01 - 2014-10-28 18:01 - 00000954 _____ () C:\EamClean.log
2014-10-28 09:34 - 2014-10-28 09:34 - 00272808 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2014-10-28 09:34 - 2014-10-28 09:34 - 00175528 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2014-10-28 09:34 - 2014-10-28 09:34 - 00175528 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2014-10-28 09:34 - 2014-10-28 09:34 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2014-10-28 09:34 - 2014-10-28 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-10-28 09:29 - 2014-10-28 09:35 - 00001678 _____ () C:\windows\SecuniaPackage.log
2014-10-28 09:20 - 2014-10-28 09:20 - 00001040 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-10-28 09:20 - 2014-10-28 09:20 - 00000000 ____D () C:\Users\Helmut\AppData\Local\Secunia PSI
2014-10-28 09:19 - 2014-10-28 09:19 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-10-28 09:18 - 2014-10-28 09:19 - 05329480 _____ (Secunia) C:\Users\Helmut\Downloads\PSISetup.exe
2014-10-27 17:29 - 2014-10-28 11:32 - 00000280 _____ () C:\windows\Tasks\Uninstaller_SkipUac_Helmut.job
2014-10-27 12:45 - 2014-10-27 12:45 - 01649619 _____ () C:\Users\Helmut\Downloads\wkg2.0.1.78.exe
2014-10-26 18:58 - 2014-10-26 18:58 - 00001236 _____ () C:\Users\Helmut\Desktop\AdwCleaner_4.001.exe - Verknüpfung.lnk
2014-10-26 18:40 - 2014-10-26 18:40 - 01962496 _____ () C:\Users\Helmut\Downloads\AdwCleaner_4.001.exe
2014-10-26 14:34 - 2014-10-26 14:34 - 02113024 _____ (Farbar) C:\Users\Helmut\Desktop\FRST64.exe
2014-10-26 10:13 - 2014-10-26 10:13 - 32601272 _____ (Microsoft Corporation) C:\Users\Helmut\Downloads\Windows-KB890830-x64-V5.17.exe
2014-10-26 09:27 - 2014-09-05 03:11 - 06584320 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2014-10-26 09:27 - 2014-09-05 02:52 - 05703168 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2014-10-25 10:50 - 2013-10-02 03:22 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\Drivers\TsUsbFlt.sys
2014-10-25 10:50 - 2013-10-02 03:11 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-10-25 10:50 - 2013-10-02 03:08 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-10-25 10:50 - 2013-10-02 02:48 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\MsRdpWebAccess.dll
2014-10-25 10:50 - 2013-10-02 02:48 - 00018944 _____ (Microsoft Corporation) C:\windows\system32\wksprtPS.dll
2014-10-25 10:50 - 2013-10-02 02:29 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\tsgqec.dll
2014-10-25 10:50 - 2013-10-02 02:10 - 00044544 _____ (Microsoft Corporation) C:\windows\system32\TsUsbGDCoInstaller.dll
2014-10-25 10:50 - 2013-10-02 01:15 - 01057280 _____ (Microsoft Corporation) C:\windows\system32\rdvidcrl.dll
2014-10-25 10:50 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\MsRdpWebAccess.dll
2014-10-25 10:50 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wksprtPS.dll
2014-10-25 10:50 - 2013-10-02 01:08 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2014-10-25 10:50 - 2013-10-02 01:01 - 00420864 _____ (Microsoft Corporation) C:\windows\system32\wksprt.exe
2014-10-25 10:50 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\windows\SysWOW64\tsgqec.dll
2014-10-25 10:50 - 2013-10-02 00:31 - 01147392 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe
2014-10-25 10:50 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rdvidcrl.dll
2014-10-25 10:50 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstsc.exe
2014-10-25 09:03 - 2014-10-25 09:03 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\Awesomium
2014-10-24 18:35 - 2014-10-25 09:49 - 00002247 _____ () C:\Users\Helmut\Desktop\Privacy Optimizer.lnk
2014-10-24 18:35 - 2014-10-24 18:35 - 00002013 _____ () C:\Users\Helmut\Desktop\Anonymous Browser.lnk
2014-10-24 18:35 - 2014-10-24 18:35 - 00000000 ____D () C:\windows\System32\Tasks\Badosoft
2014-10-24 18:35 - 2014-10-24 18:35 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Badosoft
2014-10-24 18:34 - 2014-10-24 18:34 - 00000000 ____D () C:\Program Files\Badosoft
2014-10-22 16:12 - 2014-10-22 16:12 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\Dropbox
2014-10-22 16:07 - 2014-10-22 16:10 - 00000000 ____D () C:\windows\SysWOW64\vbox
2014-10-22 16:07 - 2014-10-22 16:10 - 00000000 ____D () C:\windows\system32\vbox
2014-10-22 16:01 - 2014-10-22 16:01 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\AVAST Software
2014-10-22 16:00 - 2014-10-22 16:00 - 00001975 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2014-10-22 16:00 - 2014-10-22 16:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2014-10-22 15:59 - 2014-10-27 08:54 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update
2014-10-22 15:58 - 2014-10-22 15:59 - 36818984 _____ (Dropbox, Inc.) C:\Users\Public\Desktop\DropboxInstallerAvast.exe
2014-10-22 15:58 - 2014-10-22 15:57 - 00436624 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys
2014-10-22 15:58 - 2014-10-22 15:57 - 00267632 _____ () C:\windows\system32\Drivers\aswVmm.sys
2014-10-22 15:58 - 2014-10-22 15:57 - 00116728 _____ (AVAST Software) C:\windows\system32\Drivers\aswStm.sys
2014-10-22 15:58 - 2014-10-22 15:57 - 00093568 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2014-10-22 15:58 - 2014-10-22 15:57 - 00082768 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2014-10-22 15:58 - 2014-10-22 15:57 - 00065776 _____ () C:\windows\system32\Drivers\aswRvrt.sys
2014-10-22 15:58 - 2014-10-22 15:57 - 00029208 _____ () C:\windows\system32\Drivers\aswHwid.sys
2014-10-22 15:57 - 2014-10-22 15:57 - 01049920 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys
2014-10-22 15:57 - 2014-10-22 15:57 - 00364512 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2014-10-22 15:57 - 2014-10-22 15:57 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr
2014-10-22 15:55 - 2014-10-22 15:55 - 00000000 ____D () C:\Program Files\AVAST Software
2014-10-22 15:53 - 2014-10-22 15:55 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-10-22 15:50 - 2014-10-22 15:53 - 131078000 _____ (AVAST Software) C:\Users\Public\Desktop\avast_free_antivirus_setup.exe
2014-10-22 15:50 - 2014-10-22 15:53 - 131078000 _____ (AVAST Software) C:\Users\Helmut\Downloads\avast_free_antivirus_setup.exe
2014-10-21 15:48 - 2014-10-21 15:48 - 00000017 _____ () C:\windows\SysWOW64\shortcut_ex.dat
2014-10-21 15:24 - 2014-10-21 15:26 - 15779840 _____ () C:\Users\Helmut\Downloads\FRITZ.Box_7330_SL.116.06.03(1).image
2014-10-21 15:19 - 2014-10-21 15:19 - 15779840 _____ () C:\Users\Helmut\Desktop\FRITZ.Box_7330_SL.116.06.03.image
2014-10-20 23:24 - 2014-10-20 23:28 - 00000000 ____D () C:\ProgramData\MFAData
2014-10-20 23:24 - 2014-10-20 23:24 - 00000000 ____D () C:\Users\Helmut\AppData\Local\MFAData
2014-10-20 23:24 - 2014-10-20 23:24 - 00000000 ____D () C:\Users\Helmut\AppData\Local\Avg2015
2014-10-20 22:50 - 2014-10-20 23:13 - 00000857 _____ () C:\Users\Helmut\Downloads\Stinger_20102014_235041.html
2014-10-20 22:49 - 2014-10-20 23:17 - 00000116 ___RH () C:\Users\Helmut\Downloads\Stinger.opt
2014-10-20 22:48 - 2014-10-20 23:17 - 00000000 ____D () C:\Program Files\stinger
2014-10-20 22:48 - 2014-10-20 22:48 - 14192496 _____ (McAfee Inc) C:\Users\Helmut\Downloads\stinger64.exe
2014-10-20 16:58 - 2014-10-20 16:58 - 01705698 _____ (Thisisu) C:\Users\Helmut\Downloads\JRT633.exe
2014-10-19 17:48 - 2014-10-19 17:48 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\LavasoftStatistics
2014-10-19 17:45 - 2014-10-22 15:09 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-10-19 17:44 - 2014-10-19 17:44 - 00000000 ____D () C:\Program Files (x86)\Lavasoft
2014-10-19 17:40 - 2014-10-19 17:40 - 01753736 _____ () C:\Users\Helmut\Downloads\Adaware_Installer.exe
2014-10-19 17:20 - 2014-10-19 17:24 - 174325760 _____ () C:\Users\Helmut\Downloads\reparaturdatentraeger_windows_7_64_bit.iso
2014-10-19 17:12 - 2014-10-19 17:12 - 00001104 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Baseline Security Analyzer 2.3.lnk
2014-10-19 17:12 - 2014-10-19 17:12 - 00001092 _____ () C:\Users\Public\Desktop\Microsoft Baseline Security Analyzer 2.3.lnk
2014-10-19 17:12 - 2014-10-19 17:12 - 00000000 ____D () C:\Program Files\Microsoft Baseline Security Analyzer 2
2014-10-19 17:10 - 2014-10-19 17:10 - 01802240 _____ () C:\Users\Helmut\Downloads\MBSASetup-x64-DE.msi
2014-10-19 08:28 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-10-19 08:28 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\windows\system32\dfshim.dll
2014-10-19 08:28 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\windows\SysWOW64\dfshim.dll
2014-10-19 08:28 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\windows\SysWOW64\mscorier.dll
2014-10-19 08:28 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\windows\system32\mscorier.dll
2014-10-19 08:28 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\windows\SysWOW64\mscories.dll
2014-10-19 08:28 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\windows\system32\mscories.dll
2014-10-19 08:27 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-10-19 08:27 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2014-10-19 08:27 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-10-19 08:27 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-10-19 08:27 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-10-19 08:27 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-10-19 08:27 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-10-19 08:27 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-10-19 08:27 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-10-19 08:27 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-10-19 08:27 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-10-19 08:27 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-10-19 08:27 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-10-19 08:27 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-10-19 08:27 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-10-19 08:27 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-10-19 08:27 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-10-19 08:27 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-10-19 08:27 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-10-19 08:27 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-10-19 08:27 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-10-19 08:27 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-10-19 08:27 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-10-19 08:27 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-10-19 08:27 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-10-19 08:27 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-10-19 08:27 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-10-19 08:27 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-10-19 08:27 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-10-19 08:27 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-10-19 08:27 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-10-19 08:27 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-10-19 08:27 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-10-19 08:27 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-10-19 08:27 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-10-19 08:27 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-10-19 08:27 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-10-19 08:27 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-10-19 08:27 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-10-19 08:27 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-10-19 08:27 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-10-19 08:27 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-10-19 08:27 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-10-19 08:27 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-10-19 08:27 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-10-19 08:27 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-10-19 08:27 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-10-19 08:27 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-10-19 08:27 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-10-19 08:27 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-19 08:27 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-10-19 08:27 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-10-19 08:27 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-10-19 08:27 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2014-10-19 08:27 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-10-19 08:27 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-10-19 08:27 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-10-19 08:27 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-10-19 08:27 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-10-19 08:26 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-10-19 08:25 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2014-10-19 08:25 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2014-10-19 08:24 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll
2014-10-19 08:24 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\windows\SysWOW64\rastls.dll
2014-10-19 08:24 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
2014-10-19 08:24 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2014-10-19 08:24 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\winsta.dll
2014-10-19 08:24 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\windows\system32\rdpcorekmts.dll
2014-10-19 08:24 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2014-10-19 08:24 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2014-10-19 08:24 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\windows\SysWOW64\winsta.dll
2014-10-19 08:24 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2014-10-19 08:24 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2014-10-19 08:24 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpwd.sys
2014-10-19 08:24 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys
2014-10-19 08:23 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
2014-10-19 08:23 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
2014-10-17 07:48 - 2014-10-17 07:48 - 36865528 _____ () C:\Users\Helmut\Downloads\WEB.DE_Firefox_Setup(5).exe
2014-10-16 12:15 - 2014-10-16 12:15 - 00000000 ____D () C:\ProgramData\Emsisoft
2014-10-16 10:06 - 2014-10-16 10:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2014-10-16 10:05 - 2014-10-16 10:05 - 00001062 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-10-16 10:04 - 2014-10-28 21:16 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-10-16 09:15 - 2014-10-16 09:15 - 00000407 _____ () C:\Users\Helmut\Downloads\EmsisoftAntiMalware457Setup(1).exe
2014-10-16 08:56 - 2014-10-16 10:04 - 163225944 _____ (Emsisoft GmbH ) C:\Users\Helmut\Downloads\EmsisoftAntiMalware457Setup.exe
2014-10-15 22:34 - 2014-10-15 22:35 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Helmut\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-10-15 15:33 - 2014-10-15 15:33 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\ProductData
2014-10-15 15:31 - 2014-10-15 15:31 - 00002892 _____ () C:\windows\System32\Tasks\Uninstaller_SkipUac_Helmut
2014-10-15 15:31 - 2014-10-15 15:31 - 00001151 _____ () C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2014-10-15 15:31 - 2014-10-15 15:31 - 00001127 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-10-15 15:22 - 2014-10-15 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
2014-10-15 15:22 - 2014-10-15 15:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-10-15 15:19 - 2014-10-15 15:22 - 02365840 _____ () C:\Users\Helmut\Downloads\SecurityTaskManager_Setup(1).exe
2014-10-15 11:08 - 2014-10-15 11:08 - 03455840 _____ (tuneuppro.com ) C:\Users\Helmut\Downloads\tuppsetup_2005.exe
2014-10-13 16:11 - 2014-10-13 16:11 - 00000047 _____ () C:\Users\Helmut\AppData\Roaming\WB.CFG
2014-10-13 15:13 - 2014-10-13 15:23 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\Panda Security
2014-10-13 15:11 - 2014-10-13 15:24 - 00000000 ____D () C:\ProgramData\Panda Security
2014-10-13 15:11 - 2014-10-13 15:24 - 00000000 ____D () C:\Program Files (x86)\Panda Security
2014-10-12 18:01 - 2014-10-12 18:01 - 00000000 ____D () C:\Users\Helmut\AppData\Local\Adobe
2014-10-12 16:01 - 2014-10-12 16:01 - 00000000 ____D () C:\Users\Public\Foxit Software
2014-10-12 16:00 - 2014-10-12 16:00 - 00001329 _____ () C:\Users\Public\Desktop\Foxit Reader.lnk
2014-10-12 16:00 - 2014-10-12 16:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
2014-10-12 15:56 - 2014-10-12 15:57 - 46342192 _____ (Foxit Corporation ) C:\Users\Helmut\Downloads\FoxitReader615.0624_prom_L10N_Setup.exe
2014-10-12 15:48 - 2014-10-22 08:29 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\Foxit Software
2014-10-12 15:47 - 2014-10-12 16:00 - 00000000 ____D () C:\Program Files (x86)\Foxit Software
2014-10-12 15:46 - 2014-10-12 15:46 - 37730024 _____ (Foxit Software Inc. ) C:\Users\Helmut\Downloads\FoxitReader703.0916_enu_Setup.exe
2014-10-12 15:41 - 2014-10-12 15:41 - 37963088 _____ (Foxit Software Inc. ) C:\Users\Helmut\Downloads\FoxitReader703.0916_prom_enu_Setup.exe
2014-10-08 16:02 - 2014-10-08 16:02 - 00000011 ____R () C:\windows\amunres.lsl
2014-10-08 15:43 - 2014-10-08 15:43 - 00000000 ____D () C:\windows\ERUNT
2014-10-08 15:42 - 2014-10-08 15:42 - 01705141 _____ (Thisisu) C:\Users\Helmut\Downloads\JRT.exe
2014-10-07 15:12 - 2014-10-07 15:12 - 04393424 _____ (Systweak Inc ) C:\Users\Helmut\Downloads\rcpsetup_2005.exe
2014-10-07 09:33 - 2014-10-07 09:46 - 00000000 ____D () C:\ProgramData\OnlineArmor
2014-10-07 09:33 - 2014-10-07 09:34 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\OnlineArmor
2014-10-07 09:30 - 2014-10-28 18:08 - 00000000 ____D () C:\Program Files (x86)\Online Armor
2014-10-07 09:30 - 2014-10-07 22:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Online Armor
2014-10-07 09:30 - 2014-10-07 09:30 - 00001126 _____ () C:\Users\Helmut\Desktop\Online Armor.lnk
2014-10-07 09:30 - 2013-10-11 02:41 - 00062008 _____ () C:\windows\SysWOW64\Drivers\oahlp64.sys
2014-10-07 09:30 - 2013-10-11 02:40 - 00064720 _____ () C:\windows\SysWOW64\Drivers\OADriver.sys
2014-10-07 09:30 - 2013-10-11 02:40 - 00052360 _____ (Emsisoft) C:\windows\SysWOW64\Drivers\OAmon.sys
2014-10-07 09:30 - 2013-10-11 02:40 - 00035368 _____ (Emsisoft) C:\windows\system32\Drivers\OAnet.sys
2014-10-05 19:01 - 2014-10-27 17:23 - 00000000 ____D () C:\ProgramData\Malwarebytes Anti-Exploit
2014-10-05 19:01 - 2014-10-05 19:01 - 00001073 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Exploit.lnk
2014-10-05 19:01 - 2014-10-05 19:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit
2014-10-05 19:01 - 2014-10-05 19:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Exploit
2014-10-05 19:00 - 2014-10-05 19:00 - 02737592 _____ (Malwarebytes ) C:\Users\Helmut\Downloads\mbae-setup-1.04.1.1012.exe
2014-10-05 18:57 - 2014-10-05 18:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Helmut\Downloads\mbam-setup-2.0.2.1012(2).exe
2014-10-05 18:47 - 2014-10-05 18:47 - 02454688 _____ (Malwarebytes ) C:\Users\Helmut\Downloads\mbae-setup-0.10.0.1000.exe
2014-10-05 18:20 - 2014-10-05 18:20 - 00000000 ____D () C:\Users\Helmut\Desktop\HashTab Shell Extension
2014-10-05 18:11 - 2014-10-05 18:11 - 00000000 ____D () C:\Program Files\HashTab Shell Extension
2014-10-05 18:07 - 2014-10-05 18:11 - 01217455 _____ () C:\Users\Helmut\Downloads\HashTab_v4.0.0_Setup.exe
2014-10-05 17:31 - 2014-10-05 17:31 - 00663680 _____ (Softwareentwicklung Patric Remus -ArchiCrypt) C:\Users\Helmut\Downloads\abtde.exe
2014-10-05 17:19 - 2014-10-05 17:19 - 00001888 _____ () C:\Users\Helmut\Desktop\xp-AntiSpy.lnk
2014-10-05 17:19 - 2014-10-05 17:19 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\xp-AntiSpy
2014-10-05 17:19 - 2014-10-05 17:19 - 00000000 ____D () C:\Program Files (x86)\xp-AntiSpy
2014-10-05 17:15 - 2014-10-05 17:18 - 00427218 _____ () C:\Users\Helmut\Downloads\xp-AntiSpy_setup-deutsch_CB-DL-Manager [1].exe
2014-10-05 17:15 - 2014-10-05 17:15 - 00816064 _____ ( ) C:\Users\Helmut\Downloads\xp-AntiSpy_setup-deutsch_CB-DL-Manager.exe
2014-10-05 11:07 - 2014-10-05 11:07 - 02365840 _____ () C:\Users\Helmut\Downloads\SecurityTaskManager_Setup.exe
2014-10-04 11:22 - 2014-10-28 21:18 - 01483679 _____ () C:\windows\WindowsUpdate.log
2014-10-04 11:22 - 2014-10-20 08:17 - 00001945 _____ () C:\windows\epplauncher.mif
2014-10-04 11:21 - 2014-10-20 08:17 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-10-04 11:21 - 2014-10-20 08:17 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-10-04 11:19 - 2014-10-04 11:22 - 00000000 ____D () C:\36cdcacaf060db10e05bc3e7f70dc3
2014-10-04 11:16 - 2014-10-04 11:19 - 14107296 _____ (Microsoft Corporation) C:\Users\Helmut\Downloads\mseinstall.exe
2014-10-03 21:27 - 2014-10-03 21:28 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Helmut\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-10-03 14:33 - 2014-10-25 09:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-03 14:33 - 2014-10-25 08:42 - 00001073 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-03 14:33 - 2014-10-25 08:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-03 14:33 - 2014-10-01 10:11 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-10-03 14:33 - 2014-10-01 10:11 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-10-03 14:33 - 2014-10-01 10:11 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-10-03 14:32 - 2014-10-03 14:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Helmut\Downloads\mbam-setup-2.0.2.1012.exe
2014-10-03 08:56 - 2014-10-03 08:56 - 00000000 ____H () C:\windows\system32\Drivers\Msft_Kernel_GDKBFlt64_01007.Wdf
2014-10-03 08:13 - 2014-10-03 08:15 - 200825928 _____ (G Data Software AG) C:\Users\Helmut\Desktop\INT_R_BASE_2015_IS.exe
2014-10-01 14:02 - 2014-10-01 14:04 - 01617688 _____ () C:\avkhttp_.log
2014-10-01 14:02 - 2014-10-01 14:04 - 00076352 _____ () C:\windows\SysWOW64\_avkhttp_sum.txt
2014-10-01 08:26 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2014-10-01 08:26 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2014-10-01 08:25 - 2014-10-01 08:25 - 00411144 _____ () C:\Users\Helmut\Desktop\AVCleaner.exe
2014-10-01 08:19 - 2014-10-01 08:24 - 420397368 _____ (G Data Software AG) C:\Users\Helmut\Desktop\GER_R_FUL_CBE_IS.exe
2014-09-30 12:24 - 2014-09-30 12:24 - 00000000 ____D () C:\Users\Helmut\AppData\Local\G DATA
2014-09-30 09:49 - 2014-09-30 09:49 - 00003304 ____N () C:\bootsqm.dat
2014-09-30 08:53 - 2014-10-03 08:55 - 00003895 _____ () C:\Users\Helmut\AppData\Roaming\gdscan.log
2014-09-30 08:53 - 2014-09-30 08:53 - 00000000 _____ () C:\Users\Helmut\AppData\Roaming\gdfw.log
2014-09-30 08:50 - 2014-10-03 09:38 - 00000000 ____D () C:\Program Files (x86)\G Data

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-28 21:24 - 2011-02-11 09:50 - 00735642 _____ () C:\windows\system32\perfh013.dat
2014-10-28 21:24 - 2011-02-11 09:50 - 00153310 _____ () C:\windows\system32\perfc013.dat
2014-10-28 21:24 - 2011-02-11 09:40 - 00732190 _____ () C:\windows\system32\perfh010.dat
2014-10-28 21:24 - 2011-02-11 09:40 - 00147054 _____ () C:\windows\system32\perfc010.dat
2014-10-28 21:24 - 2011-02-11 09:31 - 00737860 _____ () C:\windows\system32\perfh00C.dat
2014-10-28 21:24 - 2011-02-11 09:31 - 00149788 _____ () C:\windows\system32\perfc00C.dat
2014-10-28 21:24 - 2011-02-11 09:21 - 00699682 _____ () C:\windows\system32\perfh007.dat
2014-10-28 21:24 - 2011-02-11 09:21 - 00149790 _____ () C:\windows\system32\perfc007.dat
2014-10-28 21:24 - 2009-07-14 06:13 - 04275022 _____ () C:\windows\system32\PerfStringBackup.INI
2014-10-28 18:27 - 2014-08-15 11:06 - 00000000 ____D () C:\Users\Helmut\AppData\Local\CrashDumps
2014-10-28 18:13 - 2009-07-14 05:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-28 18:13 - 2009-07-14 05:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-28 18:03 - 2014-01-06 23:54 - 00000000 ____D () C:\ProgramData\ProductData
2014-10-28 16:47 - 2014-04-27 08:26 - 00000000 ____D () C:\Users\Helmut\Desktop\Alte Firefox-Daten
2014-10-28 12:08 - 2012-11-10 09:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2014-10-28 12:08 - 2012-11-10 09:35 - 00000000 ____D () C:\Program Files (x86)\Ashampoo
2014-10-28 11:45 - 2014-02-17 18:24 - 04189188 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2014-10-28 09:35 - 2012-05-10 22:25 - 00701104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-10-28 09:35 - 2012-05-10 22:25 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-28 09:35 - 2012-05-10 22:25 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-10-28 09:34 - 2012-05-10 21:55 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-28 09:33 - 2014-05-10 16:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-27 17:08 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF
2014-10-27 10:02 - 2014-01-07 09:00 - 88076288 _____ () C:\windows\system32\config\SOFTWARE.iodefrag.bak
2014-10-27 10:02 - 2014-01-07 08:59 - 05562368 _____ () C:\windows\system32\config\DEFAULT.iodefrag.bak
2014-10-27 10:02 - 2014-01-07 08:59 - 00061440 _____ () C:\windows\system32\config\SAM.iodefrag.bak
2014-10-27 10:02 - 2014-01-07 08:59 - 00028672 _____ () C:\windows\system32\config\SECURITY.iodefrag.bak
2014-10-27 10:02 - 2012-11-06 11:41 - 00000000 ____D () C:\Users\Helmut
2014-10-27 10:00 - 2012-05-10 22:30 - 00001124 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-27 08:54 - 2013-12-27 18:24 - 00000408 _____ () C:\windows\Tasks\DriverEasy Scheduled Scan.job
2014-10-26 19:59 - 2012-05-10 22:30 - 00001120 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-26 19:15 - 2014-04-25 08:11 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-26 18:50 - 2014-02-16 16:10 - 00000424 _____ () C:\windows\Tasks\Wise Care 365.job
2014-10-26 18:50 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-10-26 18:46 - 2014-02-14 11:28 - 00000000 ____D () C:\AdwCleaner
2014-10-26 16:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-10-26 16:53 - 2014-02-17 18:25 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\SoftGrid Client
2014-10-26 16:33 - 2014-02-16 16:10 - 00000404 _____ () C:\windows\Tasks\Wise Turbo Checker.job
2014-10-25 11:06 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-25 09:39 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\Cursors
2014-10-25 08:57 - 2013-10-20 17:10 - 00000000 ____D () C:\Program Files (x86)\StarBurn Software
2014-10-22 15:59 - 2014-09-17 14:42 - 00002064 _____ () C:\windows\Sandboxie.ini
2014-10-19 09:12 - 2009-07-14 05:45 - 00269272 _____ () C:\windows\system32\FNTCACHE.DAT
2014-10-19 09:06 - 2014-04-23 16:37 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-10-19 08:54 - 2013-08-17 11:14 - 00000000 ____D () C:\windows\system32\MRT
2014-10-17 13:43 - 2014-01-06 23:54 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\IObit
2014-10-17 13:43 - 2014-01-06 23:54 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-10-17 09:33 - 2012-11-06 15:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-17 07:50 - 2012-11-06 15:50 - 00001130 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-17 07:50 - 2012-11-06 15:50 - 00001118 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-10-15 15:50 - 2014-02-06 19:32 - 00000000 ____D () C:\Users\Helmut\AppData\Local\PasswordSafe
2014-10-15 15:42 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\LiveKernelReports
2014-10-15 15:07 - 2014-09-17 14:40 - 00003858 _____ () C:\windows\System32\Tasks\Opera scheduled Autoupdate 1410961218
2014-10-15 15:07 - 2014-09-17 14:40 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-10-15 15:03 - 2014-03-19 16:29 - 00002297 _____ () C:\Users\Public\Desktop\Advanced SystemCare Ultimate 7.lnk
2014-10-14 16:06 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\Web
2014-10-14 08:40 - 2014-09-23 14:59 - 00058408 _____ () C:\Users\Helmut\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-12 18:16 - 2014-06-18 22:20 - 00000000 ____D () C:\Users\Helmut\Desktop\Neuer Ordner (3)
2014-10-12 18:14 - 2014-06-05 17:27 - 00000000 ____D () C:\Users\Helmut\Desktop\C5
2014-10-12 18:03 - 2014-08-19 20:43 - 00126976 ___SH () C:\Users\Helmut\Desktop\Thumbs.db
2014-10-07 09:19 - 2009-07-14 06:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2014-10-05 19:10 - 2009-07-14 06:08 - 00032632 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2014-10-05 18:48 - 2014-04-25 08:10 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-03 14:54 - 2012-06-02 04:17 - 00000000 ____D () C:\windows\OemDrv
2014-10-03 10:02 - 2012-11-09 22:57 - 103265616 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-10-03 09:37 - 2012-11-06 15:27 - 00000000 ____D () C:\ProgramData\G DATA
2014-10-02 14:53 - 2010-11-21 04:27 - 00278152 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2014-10-02 11:36 - 2014-02-16 16:37 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-10-02 11:36 - 2012-11-08 09:36 - 00000000 ____D () C:\Users\Helmut\AppData\Roaming\GlarySoft
2014-10-02 08:12 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Helmut\AppData\Local\8pecxstudios
2014-09-30 11:26 - 2010-11-21 08:06 - 00000000 ____D () C:\windows\SysWOW64\sysprep
2014-09-30 11:26 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\SysWOW64\Setup
2014-09-30 11:26 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\SysWOW64\oobe
2014-09-30 11:26 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\SysWOW64\MUI
2014-09-30 11:26 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\SysWOW64\IME
2014-09-30 11:26 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\SysWOW64\com
2014-09-29 08:10 - 2013-11-08 16:32 - 00039065 ____H () C:\windows\SysWOW64\BTImages.dat

Files to move or delete:
====================
C:\Users\Helmut\mp3DirectCut.exe


Some content of TEMP:
====================
C:\Users\Helmut\AppData\Local\Temp\MusicStudio.exe
C:\Users\Helmut\AppData\Local\Temp\uninstall.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-01-10 20:15

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-10-2014
Ran by Helmut at 2014-10-28 21:25:29
Running from C:\Users\Helmut\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AV: Advanced SystemCare Ultimate (Disabled - Up to date) {1C304DC4-1D72-5DB9-B33A-43B638ECFD30}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: IObit Malware Fighter (Enabled - Up to date) {A751AC20-3B48-5237-898A-78C4436BB78D}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.293 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\{BC8AC77D-6A6F-491F-BEED-2958F09C6CAE}) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\{AF82C1A9-56DC-4CCD-A36C-CAE56D541DFA}) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Advanced SystemCare Ultimate 7 (HKLM-x32\...\Advanced SystemCare Ultimate_is1) (Version: 7.0.1 - IObit)
AMD APP SDK Runtime (Version: 10.0.851.6 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{F856881A-D370-B1A7-2AFF-128F4AA93558}) (Version: 3.0.859.0 - Advanced Micro Devices, Inc.)
Ashampoo Burning Studio 2014 v.12.0.5 (HKLM-x32\...\{91B33C97-280F-B76D-E27B-E712D7041B76}_is1) (Version: 12.0.5 - Ashampoo GmbH & Co. KG)
Ashampoo Magical Defrag 3 (HKLM-x32\...\Ashampoo Magical Defrag 3_is1) (Version: 3.0.2 - ashampoo GmbH & Co. KG)
Ashampoo Music Studio 4 v.4.1.2 (HKLM-x32\...\{91B33C97-7650-0EB0-B6C7-DDBA2932B7B4}_is1) (Version: 4.1.2 - Ashampoo GmbH & Co. KG)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2206 - AVAST Software)
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v9.10.13(T) - TOSHIBA CORPORATION)
CCleaner (HKLM\...\CCleaner) (Version: 4.13 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.3868 - CDBurnerXP)
COMPUTER BILD Account-Alarm (HKLM-x32\...\{04B0A9F1-070A-4C32-A575-6D2DC8F5C52E}) (Version: 1.0.3 - J3S)
COMPUTERBILD-Abzockschutz (HKLM-x32\...\{E694FF1B-431B-4307-A021-016FAF49D443}) (Version: 1.0.53 - J3S)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dream Pinball 3D (HKLM-x32\...\Dream Pinball 3D) (Version: 1.1.0.0 - TopWare Interactive)
Driver Booster (HKLM-x32\...\Driver Booster_is1) (Version: 1.5 - IObit)
EaseUS Todo Backup Home 7.0 (HKLM-x32\...\EaseUS Todo Backup_is1) (Version: 7.0 - CHENGDU YIWO Tech Development Co., Ltd)
Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 9.0 - Emsisoft GmbH)
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.5.129.617 - Foxit Corporation)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.5.624 - Foxit Corporation)
Free Audio Converter version 5.0.48.922 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.48.922 - DVDVideoSoft Ltd.)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
HashTab 4.0.0.1 (HKLM\...\HashTab) (Version: 4.0.0.1 - Implbits Software)
herdProtect Anti-Malware Scanner (HKLM-x32\...\herdProtectScan) (Version: 1.0 - Reason Company Software Inc.)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.9.254 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.31.8.1 - Intel Corporation) Hidden
Intel® Watchdog Timer Driver (Intel® WDT) (HKLM-x32\...\{3FD0C489-0F02-481a-A3E1-9754CD396761}) (Version:  - Intel Corporation)
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 4.0.4.27 - IObit)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
KiwiG Data Recovery 6.2.2 (HKLM-x32\...\KiwiG Data Recovery 6.2.2_is1) (Version:  - KiwiGeeker)
MAGIX Foto & Grafik Designer 7 SE (HKLM-x32\...\MAGIX_{305A1AC7-0B5C-457D-9B6F-2A889766E3A0}) (Version: 7.1.2.26041 - MAGIX AG)
MAGIX Foto & Grafik Designer 7 SE (Version: 7.1.2.26041 - MAGIX AG) Hidden
Malwarebytes Anti-Exploit version 1.04.1.1012 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.04.1.1012 - Malwarebytes)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Baseline Security Analyzer 2.3 (HKLM\...\{D8D25854-D7F0-45C5-8702-D650A5A23E21}) (Version: 2.3.2208 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 33.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0 (x86 de)) (Version: 33.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0 - Mozilla)
MP3jam 1.1.1.9 (HKLM-x32\...\MP3jam_is1) (Version: 1.1.1.9 - MP3jam)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Online Armor 7.0 (HKLM-x32\...\OnlineArmor_is1) (Version: 7.0 - Emsisoft GmbH)
Opera Stable 25.0.1614.50 (HKLM-x32\...\Opera 25.0.1614.50) (Version: 25.0.1614.50 - Opera Software ASA)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Premium Sound HD (HKLM\...\{3007FF9F-5B2C-41FF-8BFC-08BF25DB2681}) (Version: 1.12.1800 - SRS Labs, Inc.)
Privacy Optimizer (HKLM-x32\...\PrivacyOptimizer) (Version: 1.0 - Badosoft)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Radio.fx (HKLM-x32\...\Tobit Radio.fx Server) (Version:  - Tobit.Software)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30166 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7246 - Realtek Semiconductor Corp.)
Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0016 - REALTEK Semiconductor Corp.)
RtkClassFilter (HKLM-x32\...\InstallShield_{8220FCF2-A57F-4236-BFCC-C6C2268E851E}) (Version: 1.2.1.4 - REALTEK Semiconductor Corp)
RtkClassFilter (x32 Version: 1.2.1.4 - REALTEK Semiconductor Corp) Hidden
Sandboxie 4.12 (64-bit) (HKLM\...\Sandboxie) (Version: 4.12 - Sandboxie Holdings, LLC)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Security Task Manager 1.8g (HKLM-x32\...\Security Task Manager) (Version: 1.8g - Neuber Software)
Shopping Helper Smartbar Engine (HKCU\...\{1482cd5c-ffb3-4ef7-a1d7-6c70a579c07c}) (Version: 11.43.63.16271 - ReSoft Ltd.) <==== ATTENTION
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Surfing Protection (HKLM-x32\...\IObit Surfing Protection_is1) (Version: 1.0 - IObit)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.38.2 - Synaptics Incorporated)
TOSHIBA Assist (HKLM-x32\...\{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}) (Version: 4.2.3.0 - TOSHIBA CORPORATION)
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.11 for x64 - TOSHIBA Corporation)
TOSHIBA eco Utility (HKLM\...\{2C486987-D447-4E36-8D61-86E48E24199C}) (Version: 1.3.10.64 - TOSHIBA Corporation)
TOSHIBA Hardware Setup (HKLM-x32\...\{2FD5D2C5-A7A1-4065-89BA-90542BF7CCD3}) (Version: 2.00.0020 - TOSHIBA)
TOSHIBA HDD/SSD Alert (HKLM\...\{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.11 - TOSHIBA Corporation)
Toshiba Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.04 - TOSHIBA)
TOSHIBA Media Controller (HKLM-x32\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.87.5 - TOSHIBA CORPORATION)
TOSHIBA Media Controller Plug-in (HKLM-x32\...\{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}) (Version: 1.0.7.7 - TOSHIBA CORPORATION)
TOSHIBA Online Product Information (HKLM-x32\...\{2290A680-4083-410A-ADCC-7092C67FC052}) (Version: 4.01.0000 - TOSHIBA)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.7.15.64 - TOSHIBA Corporation)
TOSHIBA Places Icon Utility (HKLM-x32\...\{461F6F0D-7173-4902-9604-AB1A29108AF2}) (Version: 1.1.1.4 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.6.52020009 - TOSHIBA CORPORATION)
TOSHIBA Recovery Media Creator Reminder (HKLM-x32\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.00.0019 - TOSHIBA)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019 - TOSHIBA) Hidden
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.1.2004 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.2.13 - TOSHIBA)
TOSHIBA Supervisor Password (HKLM-x32\...\{119826A8-4EF6-4BE5-A88B-D2D81FA7CEE2}) (Version: 2.00.0009 - TOSHIBA)
TOSHIBA TEMPRO (HKLM-x32\...\{F082CB11-4794-4259-99A1-D91BA762AD15}) (Version: 3.35 - Toshiba Europe GmbH)
TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.6.0021.640203 - TOSHIBA Corporation)
TOSHIBA Value Added Package (Version: 1.6.0021.640203 - TOSHIBA Corporation) Hidden
TOSHIBA Value Added Package (x32 Version: 1.6.0021.640203 - TOSHIBA Corporation) Hidden
TOSHIBA Web Camera Application (HKLM-x32\...\InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}) (Version: 2.0.3.33 - TOSHIBA Corporation)
TOSHIBA Web Camera Application (x32 Version: 2.0.3.33 - TOSHIBA Corporation) Hidden
WEB.DE Softwareaktualisierung (HKLM-x32\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 2.0.1.8 - 1&1 Mail & Media GmbH)
Windows Driver Package - Realtek Semiconductor Corp. RtkBtFilter Bluetooth  (12/02/2011 2.3.8.1) (HKLM\...\EA90D42054890B3938D0BEF1E8A316D20C6D6003) (Version: 12/02/2011 2.3.8.1 - Realtek Semiconductor Corp.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
xp-AntiSpy 3.98-2 (HKLM-x32\...\xp-AntiSpy) (Version:  - Christian Taubenheim)
ZoneAlarm Antivirus (x32 Version: 13.2.015.000 - Check Point Software Technologies Ltd.) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3457080408-1642351141-37163438-1000_Classes\CLSID\{00000001-0E3A-4123-8B32-4B68A91E104A}\InprocServer32 -> C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIBasePlace.dll (Toshiba Corporation)
CustomCLSID: HKU\S-1-5-21-3457080408-1642351141-37163438-1000_Classes\CLSID\{00000002-0E3A-4123-8B32-4B68A91E104A}\InprocServer32 -> C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIBasePlace.dll (Toshiba Corporation)
CustomCLSID: HKU\S-1-5-21-3457080408-1642351141-37163438-1000_Classes\CLSID\{00000003-0E3A-4123-8B32-4B68A91E104A}\InprocServer32 -> C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIBasePlace.dll (Toshiba Corporation)
CustomCLSID: HKU\S-1-5-21-3457080408-1642351141-37163438-1000_Classes\CLSID\{00000006-0E3A-4123-8B32-4B68A91E104A}\InprocServer32 -> C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIBasePlace.dll (Toshiba Corporation)

==================== Restore Points  =========================

19-10-2014 07:23:18 Windows Update
19-10-2014 07:48:16 Windows Update
19-10-2014 16:11:41 Microsoft Baseline Security Analyzer 2.3 wird installiert
19-10-2014 16:40:26 AA11
19-10-2014 17:00:03 Windows-Sicherung
20-10-2014 07:20:21 AA11
22-10-2014 14:54:41 avast! antivirus system restore point
22-10-2014 19:13:44 Windows Update
24-10-2014 07:10:23 AA11
25-10-2014 09:39:03 Windows Update
26-10-2014 08:27:40 Windows Update
26-10-2014 15:53:30 Microsoft Office Klick-und-Los 2010 wird entfernt
28-10-2014 11:09:38 TrueCrypt uninstallation

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-05-08 18:32 - 01319699 ____N C:\windows\system32\Drivers\etc\hosts
127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
127.0.0.1 2010-fr.com # hosts anti-adware / pups
127.0.0.1 2012-new.biz # hosts anti-adware / pups
127.0.0.1 212link.com # hosts anti-adware / pups
127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
127.0.0.1 24h00business.com # hosts anti-adware / pups
127.0.0.1 a.adorika.net # hosts anti-adware / pups
127.0.0.1 a.ad-sys.com # hosts anti-adware / pups
127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups
127.0.0.1 ad.adn360.com # hosts anti-adware / pups
127.0.0.1 adeartss.eu # hosts anti-adware / pups
127.0.0.1 adesoeasy.eu # hosts anti-adware / pups
127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups
127.0.0.1 adm.soft365.com # hosts anti-adware / pups
127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups
127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups
127.0.0.1 ads.adplxmd.com # hosts anti-adware / pups
127.0.0.1 ads.aff.co # hosts anti-adware / pups
127.0.0.1 ads.alpha00001.com # hosts anti-adware / pups
127.0.0.1 ads.cloud4ads.com # hosts anti-adware / pups
127.0.0.1 ads.egdating.net # hosts anti-adware / pups
127.0.0.1 ads.eorezo.com # hosts anti-adware / pups
127.0.0.1 ads.hooqy.com # hosts anti-adware / pups
127.0.0.1 ads.pornerbros.com # hosts anti-adware / pups
127.0.0.1 ads.realken.com # hosts anti-adware / pups
127.0.0.1 ads.regiedepub.com # hosts anti-adware / pups
127.0.0.1 ads.sucomspot.com # hosts anti-adware / pups

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0BFEA9E3-B952-464D-9601-6BBA24B1F3E2} - System32\Tasks\Driver Booster SkipUAC (Helmut) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe [2014-08-06] (IObit)
Task: {107630C6-7744-4679-A68E-1A3165DA793B} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3457080408-1642351141-37163438-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {187A182E-318B-40EB-9939-758258DC49C0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-28] (Adobe Systems Incorporated)
Task: {286359D4-D6F2-427B-AEBB-DD9683220245} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: {2AD88748-6CD1-4CD0-84F7-CD1AEF0D0D4C} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe
Task: {38237F2A-475E-4082-84D5-56039CB3741D} - System32\Tasks\ASC7_PerformanceMonitor => C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\Monitor.exe [2013-11-29] (IObit)
Task: {42A9B827-B025-4B27-B0E5-3EA28A0C3500} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {43EE3AF2-FE8B-49BD-A7E6-86E90F08C031} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3457080408-1642351141-37163438-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {4B5BC2FF-813C-4420-8C16-15E69BC6E6E1} - System32\Tasks\{6117ABE9-E123-46AD-9FC8-476397B019CE} => C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client.exe [2013-06-03] (Tobit.Software)
Task: {52A2E90A-DD48-44AC-9904-E4EF0A3A34C8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-10] (Google Inc.)
Task: {5C3CFD4C-F88D-4B3F-8D3D-389DD1840E4C} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
Task: {60E63221-7070-43E9-8C31-9A234AB7160D} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
Task: {70A1B003-B977-4511-BB46-E3103931FAE6} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
Task: {77E684BA-C810-4BB8-A4D5-9C9FB200421F} - System32\Tasks\Wise Turbo Checker => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe
Task: {7B1F2F0F-8BEA-4AA8-A402-E3E00ACDB514} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
Task: {7DB97CAC-37A3-4873-875A-0D43A4636DFE} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2011-07-13] (1&1 Mail & Media GmbH)
Task: {8C727A8E-DD98-4BAA-BC75-D3DCAF389D58} - System32\Tasks\DriverEasy Scheduled Scan => C:\Program Files\Easeware\DriverEasy\DriverEasy.exe
Task: {8D8D252E-3B07-4BE3-8165-65730347F07C} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3457080408-1642351141-37163438-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe
Task: {944A1C0F-EA40-4545-96C0-12DF3754AC96} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3457080408-1642351141-37163438-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {96819C8B-2FED-4200-9344-C9C89001FDB2} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: {97CACF6A-8CBE-45AA-B48C-B01DDE65C044} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-10-22] (AVAST Software)
Task: {A184A9E7-1EE3-41F0-B22B-89B644DF5303} - System32\Tasks\{7529CF68-29F5-4922-87A3-27F6B6923331} => Firefox.exe 
Task: {A3407E2C-DB00-44FA-AF56-1CB210C3D7CB} - System32\Tasks\Wise Care 365 => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
Task: {ADADC1E6-DF74-4AA8-829A-B4A44447B833} - System32\Tasks\ASC4_PerformanceMonitor => C:\Program Files (x86)\IObit\Advanced SystemCare 4\PMonitor.exe
Task: {B91AF5AF-96A1-468F-9401-1C922E1BA370} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3457080408-1642351141-37163438-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {BBAF919D-280D-4CBC-A937-305D380B951B} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3457080408-1642351141-37163438-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe
Task: {BF386F52-491F-4F95-93D1-F0369B9FCDE1} - System32\Tasks\Uninstaller_SkipUac_Helmut => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe [2014-10-15] (IObit)
Task: {DBE6A768-0B01-49C2-8371-41FEF33257A4} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-08-21] (Adobe Systems Incorporated)
Task: {DF7A83CA-622D-46F6-B7FF-8A55F5F71E21} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-3457080408-1642351141-37163438-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe
Task: {E526F0DE-7E46-4CDB-BC51-DA54E5FE925E} - System32\Tasks\ASC7U_SkipUac_Helmut => C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\ASC.exe [2013-12-02] (IObit)
Task: {EF2FFF4A-414D-4372-A137-F2AF36EB03F1} - System32\Tasks\Driver Booster SkipUAC (SYSTEM) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe [2014-08-06] (IObit)
Task: {F0DCBB90-75E5-4CB9-909E-0C3FD050BA96} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-04-17] (Piriform Ltd)
Task: {F3BF4664-3EB0-4898-992E-A3CB2C7BE20C} - System32\Tasks\Badosoft\PrivacyOptimizer => C:\Program Files\Badosoft\Privacy Optimizer\PrivacyOptimizer.exe [2014-01-08] (Badosoft)
Task: {F62A4C3B-797A-4FE8-8CAA-2581E5CF57CA} - System32\Tasks\Opera scheduled Autoupdate 1410961218 => C:\Program Files (x86)\Opera\launcher.exe [2014-10-15] (Opera Software)
Task: {F7285BC6-C170-49B2-819B-AC7E42654C63} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-10] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\DriverEasy Scheduled Scan.job => C:\Program Files\Easeware\DriverEasy\DriverEasy.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\Uninstaller_SkipUac_Helmut.job => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Task: C:\windows\Tasks\Wise Care 365.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
Task: C:\windows\Tasks\Wise Turbo Checker.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe

==================== Loaded Modules (whitelisted) =============

2012-06-02 03:48 - 2010-09-10 01:26 - 00162824 _____ () C:\Windows\System32\GFNEXSrv.exe
2012-12-24 10:18 - 2009-12-16 10:21 - 00890208 _____ () C:\Program Files (x86)\Ashampoo\Ashampoo Magical Defrag 3\defragservice.exe
2012-11-07 09:52 - 2013-06-03 12:06 - 03999512 _____ () C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
2011-11-24 21:20 - 2011-11-24 21:20 - 00593856 _____ () C:\Program Files\TOSHIBA\TECO\TecoPower.dll
2014-10-22 15:56 - 2014-10-22 15:56 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2014-10-22 15:56 - 2014-10-22 15:56 - 05846160 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2012-12-24 10:18 - 2009-12-16 10:21 - 00132448 _____ () C:\Program Files (x86)\Ashampoo\Ashampoo Magical Defrag 3\defragmonitorservice.exe
2012-12-24 10:18 - 2009-12-16 10:21 - 00083296 _____ () C:\Program Files (x86)\Ashampoo\Ashampoo Magical Defrag 3\defragActivityMonitor.exe
2011-08-22 23:19 - 2011-08-22 23:19 - 11204992 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2010-12-15 23:19 - 2010-12-15 23:19 - 00124320 _____ () C:\Program Files\TOSHIBA\TECO\MUIHelp.dll
2012-05-10 22:24 - 2011-02-22 10:16 - 00559104 _____ () C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\de\Humphrey.resources.dll
2012-05-10 22:18 - 2011-12-15 14:56 - 00022400 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\de\TosDILangPack.resources.dll
2012-05-10 22:18 - 2011-12-15 14:55 - 00063360 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIInternal.XmlSerializers.dll
2012-12-24 10:18 - 2009-12-16 10:21 - 00927072 _____ () C:\Program Files (x86)\Ashampoo\Ashampoo Magical Defrag 3\defragtaskbar.exe
2014-03-19 16:29 - 2013-09-30 15:35 - 01120064 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\RealTimeProtector.exe
2011-11-26 02:51 - 2011-11-26 02:51 - 00079784 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2014-10-22 15:56 - 2014-10-22 15:56 - 00441256 _____ () C:\Program Files\AVAST Software\Avast\ng\mftutil.exe
2014-03-19 16:29 - 2013-01-15 18:47 - 00517440 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\sqlite3.dll
2014-03-19 16:29 - 2013-11-14 16:02 - 00218944 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\Antivirus\bdfltlib.dll
2014-10-16 10:05 - 2014-10-06 17:43 - 00775400 _____ () C:\Program Files (x86)\Emsisoft Anti-Malware\fw32.dll
2014-10-28 16:41 - 2014-10-28 16:41 - 02898432 _____ () C:\Program Files\AVAST Software\Avast\defs\14102800\algo.dll
2014-10-22 15:57 - 2014-10-22 15:57 - 04491192 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2012-12-24 10:18 - 2009-12-16 11:37 - 03614016 _____ () C:\Program Files (x86)\Ashampoo\Ashampoo Magical Defrag 3\ash_inet2.dll
2012-11-07 09:52 - 2013-06-03 12:06 - 09907712 _____ () C:\Program Files (x86)\Tobit Radio.fx\Client\TOBITCLT.dll
2012-11-07 09:52 - 2013-05-16 13:28 - 00242688 _____ () C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client$.ger
2014-08-07 10:39 - 2014-08-07 10:39 - 00014336 _____ () C:\Program Files (x86)\COMPUTER BILD Account-Alarm\BCrypt.Net.dll
2014-03-19 16:29 - 2013-01-15 18:47 - 00893248 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\webres.dll
2014-10-22 15:57 - 2014-10-22 15:57 - 38561576 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-03-19 16:29 - 2013-01-15 18:48 - 00348992 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\madExcept_.bpl
2014-03-19 16:29 - 2013-01-15 18:48 - 00183616 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\madBasic_.bpl
2014-03-19 16:29 - 2013-01-15 18:48 - 00051008 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare Ultimate 7\madDisAsm_.bpl
2013-12-28 10:12 - 2013-09-16 12:20 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2012-05-07 11:55 - 2012-05-07 11:55 - 00178104 _____ () C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosGatt.dll
2014-05-10 16:14 - 2014-10-11 13:53 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:430C6D84
AlternateDataStreams: C:\ProgramData\TEMP:AD022376
AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-3457080408-1642351141-37163438-500 - Administrator - Disabled)
Gast (S-1-5-21-3457080408-1642351141-37163438-501 - Limited - Disabled)
Helmut (S-1-5-21-3457080408-1642351141-37163438-1000 - Administrator - Enabled) => C:\Users\Helmut
HomeGroupUser$ (S-1-5-21-3457080408-1642351141-37163438-1002 - Limited - Enabled)
PrivacyOptimizerFP (S-1-5-21-3457080408-1642351141-37163438-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: AntiLog32
Description: AntiLog32
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: AntiLog32
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/28/2014 09:17:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session


System errors:
=============
Error: (10/28/2014 09:20:51 PM) (Source: WMPNetworkSvc) (EventID: 14319) (User: )
Description: WMPNetworkSvc

Error: (10/28/2014 09:17:04 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (10/28/2014 09:16:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Intel(R) Capability Licensing Service Interface" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (10/28/2014 09:16:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "EaseUS Agent Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (10/28/2014 09:15:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Microsoft Antimalware Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/28/2014 09:15:55 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft Antimalware Service erreicht.

Error: (10/28/2014 09:15:55 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎28.‎10.‎2014 um 21:14:29 unerwartet heruntergefahren.

Error: (10/28/2014 09:01:02 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.

Error: (10/28/2014 06:51:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Dnscache erreicht.

Error: (10/28/2014 06:51:06 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Dnscache erreicht.


Microsoft Office Sessions:
=========================
Error: (10/28/2014 09:17:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session

Error: (10/28/2014 09:02:00 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: Failed to open session


CodeIntegrity Errors:
===================================
  Date: 2014-08-18 00:18:59.488
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\C#(TI30876100C - NTFS 1)\LostFiles1\system.data.resources_037.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-18 00:18:59.160
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\C#(TI30876100C - NTFS 1)\LostFiles1\system.data.resources_037.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-10 09:11:10.875
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-10 09:11:10.797
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-10 09:11:10.501
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-10 09:11:10.438
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-10 09:09:45.042
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-10 09:09:42.360
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-14 09:24:21.524
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-14 09:24:21.508
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz
Percentage of memory in use: 50%
Total physical RAM: 4055.8 MB
Available physical RAM: 2004.53 MB
Total Pagefile: 8109.79 MB
Available Pagefile: 5543.19 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (TI30876100C) (Fixed) (Total:578.59 GB) (Free:443.61 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596.2 GB) (Disk ID: 22EC50A7)
Partition 1: (Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Not Active) - (Size=578.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=16.1 GB) - (Type=17)

==================== End Of Log ============================
         

[/CODE]

Hallo Timo!Ich freue mich,daß du mir Helfen willst.Bitte weise mich ein was zu tun ist.Ich
bin auch nicht das Computergenie,

Hinweis: Registry Cleaner

Ich sehe, dass du sogenannte Registry Cleaner installiert hast.
In deinem Fall Advanced SystemCare Ultimate 7, CCleaner.

Wir raten von der Verwendung jeglicher Art von Registry Cleaner ab.

Der Grund ist ganz einfach:
Die Registry ist das Hirn des Systems. Funktioniert das Hirn nicht, funktioniert der Rest nicht mehr wirklich.
Man sollte nicht unnötigerweise an der Registry rumbasteln. Schon ein kleiner Fehler kann gravierende Folgen haben und auch Programme machen manchmal Fehler.
Zerstörst du die Registry, zerstörst du Windows.

Zudem ist der Nutzen zur Performancesteigerung umstritten und meist kaum im wahrnehmbaren Bereich.

Ich würde dir empfehlen, Registry Cleaner nicht weiterhin zu verwenden und über

Start --> Systemsteuerung --> Software (bei Windows XP)
Start --> Systemsteuerung --> Programme und Funktionen (bei Vista / Win 7)

zu deinstallieren.

Schritt 1:

Deinstallation von Programmen:

• Klicke auf Start
• Klicke auf Systemsteuerung
• Klicke auf Programme und Funktionen
• suche den Einträge
  

  Shopping Helper Smartbar Engine
           

• klicke jeweils mit der rechten Maustaste und wähle deinstallieren

Deinstalliere auch - falls du es nicht absichtlich installiert hast - alles was den Zusatz "Toolbar" enthält, sowie Downloader-Anwendungen

Gehe bitte die folgende Liste durch und deinstalliere die genannten Programme, falls vorhanden:
CCleaner oder andere Registry-Cleaner, TuneUp Utilities (inkl. Language Pack), Glary Utilities, Spybot S & D (inklusive Teatimer), Zonealarm Firewall, McAfee Security Scan, Spyware Hunter, Spyware Terminator, Java 6 (alle), Pokersoftware, xp-Antispy, Hotspot Shield, iLivid, Amazon Icon, DriverEasy, Advanced Driver Updater, DriverCure, Uniblue DriverScanner, FireJump, SearchAnonymizer, SpeedMaxPC

Schritt 2:

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 3:

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 4:

Ich nehme an, Malwarebytes ist auch gelaufen ? Zumind. ist es auf dem Rechner.
Falls da ein Log mit Funden ist, bitte posten.

Starte noch einmal FRST.

• Ändere keine der Voreinstellungen und drücke auf Scan.
• Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
• Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Hallo Timo.Ich habe gerade nachgesehen und habe festgestellt,daß ich eine virtuelle Festplatte auf der Festplatte habe:C#(TI30876100C - NTFS 1).Sie ist installiert am
18.8.2014 und die Ordner sind schreibgeschützt.Die Installationszeit war 6:32.Von mir ist
das nicht getätigt worden.Am 15.2.2014 hatte ich ein Systemabbild auf CD gebrannt.Habe
aber danach nichts mehr aktualisiert.Meinst du man kann die CD noch als Wiederherstellung von Windows 7 verwenden?Das wäre dann der einfachere Weg.Brauche aber die Nummer von Windows 7,ich habe nur die OEM-Version.

Wie hast du was festgestellt ?
Was für eine virtuelle Festplatte ?

Kannst du bitte Screenshots erstellen und als Anhang beim Antworten beifügen ?

Mal sehen :

Ich weiß nicht wie ich dir das übermitteln kann.Die Festplatte von meinem Laptop hat den Namen:TI30876100C (C).
Und es existiert noch mal auf der Festplatte C die Datei C#(TI30876100C-NTFS1)Ordner LostFiles1 und 451 MB 665 Ordner und
9.581 Dateien.Jedes Mal,wenn ich im Internet war wurde dies dort festgehalten.

Habe ich doch beschrieben:

Screenshot machen und beim Antworten hier auf "Anhang" klicken und den/die Screenshots anhängen.

Ich weiß nicht wie mann das macht.Bin keine Pc-Leuchte.

Zitat von hel47

Hallo Timo.Ich habe gerade nachgesehen und habe festgestellt,daß ich eine virtuelle Festplatte auf der Festplatte habe:C#(TI30876100C - NTFS 1).Sie ist installiert am
18.8.2014 und die Ordner sind schreibgeschützt.Die Installationszeit war 6:32.Von mir ist
das nicht getätigt worden.Am 15.2.2014 hatte ich ein Systemabbild auf CD gebrannt.Habe
aber danach nichts mehr aktualisiert.Meinst du man kann die CD noch als Wiederherstellung von Windows 7 verwenden?Das wäre dann der einfachere Weg.Brauche aber die Nummer von Windows 7,ich habe nur die OEM-Version.

Ordner werden in Windows 7 immer schreibgeschützt angezeigt, das hat keine Aussagekraft.

Der Ordner hat zu 100% eine legitime Funktion, wenn darin ein Ordner LostFiles1 ist, hat das nur was mit einem Checkdisk- Durchlauf zu tun.

Ja der Ordner hat seine legitime Funktion.Jetzt ist wieder Microsoft Virtual Wifi Miniport Adapter da aber deinstalliert.Wenn ich jetzt alle Programme lösche die du beanstandet hast ist es m.M. nach nur Stückwerk,also ich wäre für eine Neuinstallation.

Das steht dir natürlich frei.

Zum virtuellen WiFi Adapter:

Virtual WiFi macht Windows 7 zum Access Point - Windows 7 - Site Home - TechNet Blogs

Irgendwo habe ich mir die Shopping Helper Smartbar Engine eingefangen.Unter Programme und Funktionen bei Windows 7 kann ich sie aber nicht löschen.Weißt du Rat?

Hallo Timo!
Entschuldige bitte,daß ich mich nochmal an dich wende aber es läßt mir keine Ruhe.
Vor der Neuinstallation wollte ich noch wissen wer sich in meinen Computer gehackt hat.Habe mich durchs Forum gelesen und nach Sandras Ausführungen Revo Uninstaller geladen und die Shopping Helper Smartbar Engine gelöscht.Nun
Habe ich den ESET Onlinescanner installiert und über
30!!! Bedrohungen gefunden.Vorher hatte ich das System mit Malwarebytes gescannt,Keine Funde.
Auch der Virenscanner von Avast hat nicht angeschlagen.Ergebisse als Textdokument abgespeichert.

Wenn ich jetzt alle Programme lösche die du beanstandet hast ist es m.M. nach nur Stückwerk,also ich wäre für eine Neuinstallation.

Die beiden Aussagen passen nicht zueinander.

Deine letzte Aussage war, das du eine Neuinstallation durchführst.
Wenn du die Bereinigung jetzt doch durchfürst und das noch auf eigene Stücke, kann und werde ich dich nicht dabei unterstützen.

Diese Punkte habe ich auch hier aufgeführt.

Gib mir mal ne klare Aussage, was du vorhast.

Hallo Timo!
Ich würde die Bereinigung nach deinen Bedingungen durchführen,bist du dabei?