Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Plagegeister aller Art und deren Bekämpfung: Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 1 von 2 1 2
Alt 26.11.2014, 12:29   #1
Katzenauge88
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Hallo Leute,
ich war heut morgen so dumm und bin Opfer einer neuen Internetbetrugsmasche geworden.

Mehrere Fakoren begünstigten dies:
1. Der Hacker (englischsprachiger Mann mit indischem Akzent) klingelte mich aus meiner Tiefschlafphase in dem er mich auf mein Festnetztelefon anrief
2. Das Antivirusprogramm Avira auf meinem PC zeigte gestern eine Fehler- bzw. Virusmeldung an und deswegen glaubte ich wirklich er wolle mir helfen den Fehler zu beheben
3. Bei Windows 8 wo man ständig alles erlauben und irgendwelche persönlichen Daten angeben muss, machte es mich nicht stutzig dass ein Microsoft Mitarbeiter irgendwie meine Nummer bekommen hat.

Naja dumm und verschlafen wie ich war, folgte ich den Anweisungen des Hackers und tippte zunächst irgendwas mit eventw [...] in der suchmaschine meines PCs ein. Daraufhin öffnete sich ein fenster das ca. 9880 Fehlermedungen registriert hätte.

Daraufhin sollte ich das Programm: ammyy admin runterladen, was ich dummerweise auch tat. dann gab ich dem Anrufer meine ID (mit Bedenken, jedoch beschwichtigte er mich: wenn er ein Hacker wäre bräuchte er meine IP) und darauf ließ ich ihn gewähren.

Dann lud er teamviewer runter und meldete sich an. Daraufhin hatte er zugriff auf meinen PC und lud Advanced Windowscare und iobit freeware runter und scannte mein system. nach dem scan klickte ich auf repair...wurde stutzig und beendetet das Telefonat einfach.

Als ich jedoch sah, dass der hacker noch auf meinem sysem war und die maus bewegte, schaltetet ich den PC sofort aus und machte das internet aus.
Ich schaltete den PC wieder an und löschte alle im Verlauf des gespräches installierten programme.

Jetzt habe ich Angst, dass er noch immer Zugriff hat oder irgendetwas "eingeschleust" hat, was sich irgendwie Zugriff auf persönliche Daten Passwörter etc. verschaffen könnte...
Könnt ihr mir da helfen vielleicht mal mein System zu checken und zu gucken dass alles in Ordnung ist?

PS: Die Telefonnummer des Anrufers lautet: 005162066815 und seine Operator ID habe ich mir auch schnell aufgeschrieben: 36662398 keine Ahnung ob das weiterhilft.

Beste Grüße, freue mich auf eine Antwort!

Alt 26.11.2014, 13:20   #2
Warlord711
/// TB-Ausbilder
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Geil ! Hab ich zwar schon von gehört aber nie gedacht das die das wirklich in Deutschland machen ;-)
Achja, neu ist die nicht, nur ungewöhnlich in Deutschland, weil der Großteil der Bevölkerung des Englischem nicht mächtig ist.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Cursor zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________

__________________
Alt 26.11.2014, 14:08   #3
Katzenauge88
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-11-2014
Ran by Christina (administrator) on VFL1900 on 26-11-2014 13:59:37
Running from C:\Users\Christina\Downloads
Loaded Profiles: UpdatusUser & Christina (Available profiles: UpdatusUser & Christina)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(Search Protect) C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Pokki) C:\Users\Christina\AppData\Local\Pokki\Engine\HostAppServiceUpdater.exe
(Akamai Technologies, Inc.) C:\Users\Christina\AppData\Local\Akamai\netsession_win.exe
(Pokki) C:\Users\Christina\AppData\Local\Pokki\Engine\HostAppService.exe
(Akamai Technologies, Inc.) C:\Users\Christina\AppData\Local\Akamai\netsession_win.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Pokki) C:\Users\Christina\AppData\Local\Pokki\Engine\HostAppService.exe
(Pokki) C:\Users\Christina\AppData\Local\Pokki\Engine\StartMenuIndexer.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_239.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_239.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13538376 2013-05-13] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1307720 2013-04-24] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3016432 2013-03-07] (Synaptics Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640 2014-01-11] (APN)
HKLM-x32\...\Run: [Smart File Advisor] => C:\Program Files (x86)\Smart File Advisor\sfa.exe [283712 2013-11-26] (Filefacts.net)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-06-04] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132224 2013-02-28] ( (Atheros Communications))
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [Pokki] => "%LOCALAPPDATA%\Pokki\Engine\HostAppServiceUpdater.exe" /LOGON
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1940160 2014-11-18] (Valve Corporation)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [Akamai NetSession Interface] => C:\Users\Christina\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3600216 2014-10-11] (Electronic Arts)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [Browser Infrastructure Helper] => C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.exe [28952 2014-06-11] (Smartbar)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro 3.11\OptProLauncher.exe [148048 2014-11-20] (PC Utilities Software Limited)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\RunOnce: [Application Restart #1] => C:\Users\Christina\AppData\Local\Pokki\Engine\pokki.exe  --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-s (the data entry has 548 more characters).
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\RunOnce: [Application Restart #0] => C:\Users\Christina\AppData\Local\Pokki\Engine\HostAppService.exe [7805256 2014-11-20] (Pokki)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\MountPoints2: {1f037c66-3c1c-11e4-be8d-78843c345e4f} - "F:\Startme.exe" 
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\MountPoints2: {fe31343b-8dcd-11e3-be7b-78843c345e4f} - "D:\SETUP.EXE" 
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\MountPoints2: {feb1c31a-26f2-11e4-be8b-78843c345e4f} - "E:\SISetup.exe" 
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll [233280 2014-11-10] (Search Protect)
AppInit_DLLs:  C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [245872 2013-03-07] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll [188224 2014-11-10] (Search Protect)
AppInit_DLLs-x32:  C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [201576 2013-03-07] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2103582913-709214951-153368262-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000
HKU\S-1-5-21-2103582913-709214951-153368262-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=hp&fr=linkury-tb&installDate=09/02/2014&type=hp1000
HKU\S-1-5-21-2103582913-709214951-153368262-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
HKU\S-1-5-21-2103582913-709214951-153368262-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000
HKU\S-1-5-21-2103582913-709214951-153368262-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb4G4avepFD7B7tQI75duRaUfZXHf1FSQyNBVfTAXBd1a-J_dVGzOLjDonrTfLtbBMTxcZGNvWHWywFGDI3W3KuFT1ahW2htLnFYDyHMc1E4rSD5DXSCitsQwPxst_XW4dE6EE1NxKZLqsXe5qOPBoy0u-7tWqH1k7Vaw,,&q={searchTerms}
HKU\S-1-5-21-2103582913-709214951-153368262-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEE7E3DBD-D92D-4135-A246-F69443E9C0BB&SearchSource=55&CUI=&UM=5&UP=SPA4F92B1C-348F-43FB-8E31-CC3A2497D733&SSPV=
HKU\S-1-5-21-2103582913-709214951-153368262-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
HKU\S-1-5-21-2103582913-709214951-153368262-1002\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb4G4avepFD7B7tQI75duRaUfZXHf1FSQyNBVfTAXBd1a-J_dVGzOLjDonrTfLtbBMTxcZGNvWHWywFGDI3W3KuFT1ahW2htLnFYDyHMc1E4rSD5DXSCitsQwPxst_XW4dE6EE1NxKZLqsXe5qOPBoy0u-7tWqH1k7Vaw,,&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {7C4BC3F2-9BB5-4B11-AE8E-120F2AA7869E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM -> {7C4BC3F2-9BB5-4B11-AE8E-120F2AA7869E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000
SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000
SearchScopes: HKU\S-1-5-21-2103582913-709214951-153368262-1001 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000
SearchScopes: HKU\S-1-5-21-2103582913-709214951-153368262-1001 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000
SearchScopes: HKU\S-1-5-21-2103582913-709214951-153368262-1002 -> {4E71C441-AC1E-4B9B-9BEE-C67F9FE3AF37} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb4G4avepFD7B7tQI75duRaUfZXHf1FSQyNBVfTAXBd1a-J_dVGzOLjDonrTfLtbBMTxcZGNvWHWywFGDI3W3KuFT1ahW2htLnFYDyHMc1E4rSD5DXSCitsQwPxst_XW4dE6EE1NxKZLqsXe5qOPBoy0u-7tWqH1k7Vaw,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2103582913-709214951-153368262-1002 -> {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-iobit
BHO: Yahoo Community Smartbar (by Linkury)Engine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Yahoo Community Smartbar (by Linkury)Engine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Avira Savings Advisor BHO -> {A18A516C-AA41-46A9-92DB-60208917E442} -> C:\Program Files (x86)\avira\Internet Explorer\avira32.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: Trovi search
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Trovi search
FF Homepage: hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEE7E3DBD-D92D-4135-A246-F69443E9C0BB&SearchSource=55&CUI=&UM=5&UP=SPA4F92B1C-348F-43FB-8E31-CC3A2497D733&SSPV=
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.20 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2103582913-709214951-153368262-1002: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\searchplugins\bingp.xml
FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\searchplugins\trovi-search.xml
FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\searchplugins\Web Search.xml
FF Extension: Avira Browser Safety - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\Extensions\abs@avira.com [2014-11-19]
FF Extension: Avira Savings Advisor - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\Extensions\ciuvo-extension@avira.de [2014-02-23]
FF Extension: WEB.DE MailCheck - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\Extensions\toolbar@web.de [2014-11-26]
FF Extension: Yahoo! Toolbar - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2014-11-26]
FF Extension: Yahoo Community Smartbar - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\Extensions\{70261997-9771-8376-170f-4d937b72195f} [2014-02-09]
FF Extension: Download videos and MP3s from YouTube - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-11-24]
FF Extension: UITBAutoInstaller - C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\{edd7fc99-d65c-4979-85c2-ddeed30c50c7} [2014-11-24]
FF HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-24]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 51cdb72; c:\Program Files (x86)\Optimizer Pro 3.11\OptProCrash.dll [3105792 2014-11-24] () [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-11-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-18] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-01-11] (APN LLC.)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [227968 2013-02-28] (Qualcomm Atheros Commnucations)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2615368 2013-02-27] (Acer Incorporated)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2443960 2014-10-30] (Microsoft Corporation)
R2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [3056960 2014-11-10] (Search Protect)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [660040 2013-01-18] (Acer Incorporated)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-03-20] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-20] (Intel Corporation)
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [431656 2013-04-26] (Acer Incorporate)
S3 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [4230016 2013-01-28] (Symantec Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16032 2014-09-22] (Microsoft Corporation)
S2 McAPExe; "C:\Program Files\McAfee\MSC\McAPExe.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-02-28] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0403000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-02-09] (Disc Soft Ltd)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-01-10] (Acer Incorporated)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-03-20] (Intel Corporation)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)
S3 QRDCIO; C:\Windows\System32\drivers\QRDCIO.sys [9728 2009-10-20] (QUANTA)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [15704 2013-01-10] (Acer Incorporated)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [455240 2013-03-05] (RTS Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31984 2013-03-07] (Synaptics Incorporated)
R3 SPPD; \??\C:\Windows\system32\drivers\SPPD.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-26 13:59 - 2014-11-26 13:59 - 00026137 _____ () C:\Users\Christina\Downloads\FRST.txt
2014-11-26 13:59 - 2014-11-26 13:59 - 00000000 ____D () C:\FRST
2014-11-26 13:58 - 2014-11-26 13:58 - 02118144 _____ (Farbar) C:\Users\Christina\Downloads\FRST64.exe
2014-11-26 10:54 - 2014-11-20 21:56 - 00713672 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-26 10:54 - 2014-11-20 21:56 - 00106440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-26 10:38 - 2014-11-26 10:38 - 00000171 _____ () C:\Users\Christina\Downloads\AA_v3.5.log
2014-11-26 10:06 - 2014-11-26 10:06 - 00000131 _____ () C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\IObit Freeware.url
2014-11-26 10:06 - 2014-11-26 10:06 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-11-26 10:03 - 2014-11-26 10:03 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\TeamViewer
2014-11-26 10:03 - 2014-11-26 10:03 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-11-26 09:56 - 2014-11-26 09:56 - 00000000 ____D () C:\ProgramData\AMMYY
2014-11-25 12:25 - 2014-11-25 12:25 - 02280510 _____ () C:\Users\Christina\Downloads\Maize.crop.calendar.fill.tar.gz
2014-11-24 16:25 - 2014-11-24 16:25 - 01169232 _____ () C:\Users\Christina\Downloads\wmp81n - CHIP-Installer.exe
2014-11-24 16:23 - 2014-11-24 16:23 - 01169232 _____ () C:\Users\Christina\Downloads\Windows Media Player - CHIP-Installer(1).exe
2014-11-24 16:22 - 2014-11-24 16:22 - 01169232 _____ () C:\Users\Christina\Downloads\Windows Media Player - CHIP-Installer.exe
2014-11-24 12:27 - 2014-11-24 12:27 - 00003268 _____ () C:\Windows\System32\Tasks\Optimizer Pro Schedule
2014-11-24 12:27 - 2014-11-24 12:27 - 00000000 ____D () C:\Users\Christina\Documents\Optimizer Pro
2014-11-24 12:27 - 2014-11-24 12:27 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Optimizer Pro
2014-11-24 12:22 - 2014-11-24 12:22 - 00001103 _____ () C:\Users\Christina\Desktop\Optimizer Pro.lnk
2014-11-24 12:22 - 2014-11-24 12:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2
2014-11-24 12:22 - 2014-11-24 12:22 - 00000000 ____D () C:\Program Files (x86)\WEB.DE MailCheck
2014-11-24 12:22 - 2014-11-24 12:22 - 00000000 ____D () C:\Program Files (x86)\Optimizer Pro 3.11
2014-11-24 12:21 - 2014-11-24 12:22 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\DVDVideoSoft
2014-11-24 12:21 - 2014-11-24 12:21 - 00001536 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2014-11-24 12:21 - 2014-11-24 12:21 - 00001243 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-11-24 12:21 - 2014-11-24 12:21 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\RHEng
2014-11-24 12:21 - 2014-11-24 12:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-11-24 12:21 - 2014-11-24 12:21 - 00000000 ____D () C:\Program Files (x86)\Free Codec Pack
2014-11-24 12:21 - 2014-11-24 12:21 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-11-24 12:16 - 2014-11-24 12:17 - 34667648 _____ (DVDVideoSoft Ltd. ) C:\Users\Christina\Downloads\FreeYouTubeToMP3Converter3.12.50.1111.exe
2014-11-19 23:27 - 2014-11-08 12:22 - 00238080 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-19 23:27 - 2014-11-08 12:21 - 00827904 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 23:27 - 2014-11-08 07:57 - 00187904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-19 23:27 - 2014-11-08 07:56 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-17 22:59 - 2014-11-17 22:59 - 00001141 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-11-14 00:31 - 2014-09-22 06:53 - 00035320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-11-14 00:31 - 2014-08-26 23:08 - 00270024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-11-14 00:30 - 2014-11-05 07:40 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-14 00:30 - 2014-11-05 07:38 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-14 00:30 - 2014-11-05 04:16 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-14 00:30 - 2014-10-11 08:45 - 10115072 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-11-14 00:30 - 2014-10-11 08:44 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-14 00:30 - 2014-10-11 08:44 - 00393216 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-11-14 00:30 - 2014-10-11 08:43 - 02307072 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-11-14 00:30 - 2014-10-11 06:58 - 08858624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-11-14 00:30 - 2014-10-11 06:57 - 02416640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-14 00:30 - 2014-10-11 06:57 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-11-14 00:30 - 2014-10-11 06:56 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-11-14 00:17 - 2014-10-18 09:44 - 00778240 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-14 00:17 - 2014-10-18 08:05 - 00567808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-14 00:17 - 2014-10-11 09:35 - 00171840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-14 00:17 - 2014-10-11 08:44 - 03248640 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-11-14 00:17 - 2014-10-11 08:44 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-11-14 00:17 - 2014-10-11 08:43 - 01281536 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-14 00:17 - 2014-10-11 06:57 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-11-14 00:17 - 2014-10-11 06:41 - 00713728 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-14 00:17 - 2014-10-11 06:41 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-14 00:17 - 2014-10-11 06:05 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-14 00:17 - 2014-10-11 06:04 - 00713728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-14 00:17 - 2014-10-03 02:21 - 00522728 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-14 00:17 - 2014-10-02 23:29 - 00783872 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-14 00:17 - 2014-10-02 23:29 - 00267264 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-14 00:17 - 2014-10-02 23:29 - 00169472 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2014-11-14 00:17 - 2014-10-02 00:05 - 04068864 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-14 00:17 - 2014-09-13 07:24 - 02233152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-11-14 00:17 - 2014-09-06 01:46 - 00389176 _____ () C:\Windows\system32\ApnDatabase.xml
2014-11-14 00:17 - 2014-09-03 03:48 - 00457728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2014-11-14 00:17 - 2014-09-03 03:48 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2014-11-14 00:17 - 2014-09-03 03:22 - 00188928 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2014-11-14 00:17 - 2014-09-03 03:21 - 00623104 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2014-11-14 00:17 - 2014-09-03 03:21 - 00212992 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2014-11-14 00:17 - 2014-08-29 05:17 - 02043392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-11-14 00:17 - 2014-08-29 05:17 - 00227328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-11-14 00:17 - 2014-08-29 05:04 - 02837504 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-11-14 00:17 - 2014-08-29 05:04 - 00309248 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-11-14 00:17 - 2014-08-28 07:04 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSCOMEX.dll
2014-11-14 00:17 - 2014-08-28 07:04 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSAPI.dll
2014-11-14 00:17 - 2014-08-28 06:59 - 00616448 _____ (Microsoft Corporation) C:\Windows\system32\FXSAPI.dll
2014-11-14 00:17 - 2014-08-28 06:59 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOMEX.dll
2014-11-14 00:17 - 2014-08-28 06:59 - 00432640 _____ (Microsoft Corporation) C:\Windows\system32\FXSTIFF.dll
2014-11-14 00:17 - 2014-08-28 06:59 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\FXST30.dll
2014-11-14 00:17 - 2014-07-24 14:12 - 00328512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-11-14 00:16 - 2014-10-23 13:47 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-14 00:16 - 2014-10-23 12:04 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-14 00:16 - 2014-09-25 00:29 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-14 00:16 - 2014-09-25 00:29 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptsslp.dll
2014-11-14 00:16 - 2014-09-25 00:01 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-14 00:16 - 2014-09-25 00:01 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\ncryptsslp.dll
2014-11-14 00:16 - 2014-08-22 00:56 - 01418752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-14 00:16 - 2014-08-22 00:27 - 01845760 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-14 00:15 - 2014-10-26 02:56 - 02237952 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-14 00:15 - 2014-10-26 02:56 - 01409536 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-14 00:15 - 2014-10-26 02:56 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-11-14 00:15 - 2014-10-26 02:56 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-14 00:15 - 2014-10-26 02:55 - 19284480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-14 00:15 - 2014-10-26 02:55 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-14 00:15 - 2014-10-26 02:55 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-14 00:15 - 2014-10-26 02:55 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 15399424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-11-14 00:15 - 2014-10-26 02:53 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-14 00:15 - 2014-10-26 01:36 - 01762816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 14368768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 13758464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-14 00:15 - 2014-10-26 01:34 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-11-14 00:14 - 2014-10-26 02:56 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-11-14 00:14 - 2014-10-26 02:54 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-14 00:14 - 2014-10-26 02:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-14 00:14 - 2014-10-26 02:54 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-14 00:14 - 2014-10-26 02:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-14 00:14 - 2014-10-26 01:35 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-11-14 00:14 - 2014-10-26 01:34 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-14 00:14 - 2014-10-26 01:34 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-14 00:14 - 2014-10-26 01:34 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-14 00:14 - 2014-10-26 01:34 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-14 00:14 - 2014-10-26 01:19 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-14 00:14 - 2014-10-26 01:13 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-11-14 00:14 - 2014-10-25 22:48 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-11-10 22:54 - 2014-11-24 12:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-07 20:36 - 2014-11-07 20:36 - 01054912 _____ (Adobe) C:\Users\Christina\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
2014-11-07 20:30 - 2014-11-08 22:48 - 00000000 ____D () C:\Windows\system32\AutoUpdateLicense
2014-11-06 21:53 - 2014-11-06 21:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-11-05 11:10 - 2014-11-05 11:10 - 00000000 ____D () C:\Users\Christina\AppData\Local\ArcGISRuntime
2014-11-04 10:11 - 2014-11-04 10:20 - 00000000 ____D () C:\Users\Christina\Desktop\Singen
2014-11-04 08:52 - 2014-11-04 08:53 - 00013904 _____ () C:\Users\Christina\Downloads\mapserv.exe
2014-10-29 13:02 - 2014-10-22 04:34 - 00010777 _____ () C:\Windows\system32\AutoconfigV2.cab
2014-10-29 13:02 - 2014-10-22 04:33 - 00581016 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe
2014-10-29 13:02 - 2014-10-22 04:33 - 00462760 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-10-29 13:02 - 2014-10-22 02:08 - 00568832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-10-29 13:02 - 2014-10-22 02:08 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-29 13:02 - 2014-10-22 02:01 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-10-29 13:02 - 2014-10-22 02:01 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2014-10-29 13:02 - 2014-10-22 02:01 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-29 13:02 - 2014-10-22 02:00 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2014-10-28 18:46 - 2014-10-28 18:46 - 00000000 ____D () C:\Users\Christina\AppData\Local\Intel_Corporation
2014-10-27 15:13 - 2014-10-27 15:14 - 00000000 ____D () C:\Users\Christina\Documents\ArcGIS
2014-10-27 15:05 - 2014-10-27 15:05 - 00000000 ____D () C:\ProgramData\ESRI
2014-10-27 14:52 - 2014-11-25 18:22 - 00000000 ____D () C:\arcgis
2014-10-27 14:45 - 2014-11-26 12:59 - 00000000 ____D () C:\Users\Christina\Desktop\GIS
2014-10-27 14:45 - 2014-11-04 10:17 - 00000000 ____D () C:\Users\Christina\Desktop\Sonstiges
2014-10-27 14:41 - 2014-10-29 20:22 - 00000000 ____D () C:\Users\Christina\AppData\Local\ESRI
2014-10-27 14:41 - 2014-10-27 14:41 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\ESRI
2014-10-27 13:40 - 2014-10-27 15:11 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-10-27 13:35 - 2014-10-27 13:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS
2014-10-27 13:30 - 2014-10-27 13:30 - 00000000 ____D () C:\Python27
2014-10-27 13:30 - 2014-10-27 13:30 - 00000000 ____D () C:\Program Files (x86)\ArcGIS
2014-10-27 13:26 - 2014-10-27 14:49 - 00000000 ____D () C:\Users\Christina\Documents\ArcGIS 10.2.2

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-26 14:00 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru
2014-11-26 13:44 - 2013-11-13 11:10 - 01103630 _____ () C:\Windows\WindowsUpdate.log
2014-11-26 13:30 - 2014-07-21 12:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-26 13:20 - 2014-01-04 18:00 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-11-26 13:05 - 2012-07-26 08:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-11-26 11:44 - 2013-11-13 19:52 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2014-11-26 11:44 - 2013-11-13 19:52 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2014-11-26 11:44 - 2012-07-26 08:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-26 11:38 - 2014-03-04 14:50 - 00141968 _____ () C:\Users\Christina\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-26 11:38 - 2014-01-08 12:51 - 00000000 ____D () C:\Users\Christina\AppData\Local\Deployment
2014-11-26 11:01 - 2014-01-04 17:51 - 00003594 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2103582913-709214951-153368262-1002
2014-11-26 10:57 - 2014-09-26 17:55 - 00002114 _____ () C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk
2014-11-26 10:56 - 2014-10-25 14:15 - 00513768 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-26 10:56 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-26 10:55 - 2013-08-02 15:50 - 00174170 _____ () C:\Windows\PFRO.log
2014-11-26 10:55 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-11-26 09:47 - 2014-01-04 17:41 - 00000000 ____D () C:\Users\Christina\AppData\Local\Pokki
2014-11-25 22:16 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-11-25 21:33 - 2014-07-21 12:53 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-25 14:27 - 2014-01-04 17:42 - 00000000 ____D () C:\Users\Christina\AppData\Local\Packages
2014-11-25 13:03 - 2014-01-04 18:28 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Skype
2014-11-23 21:33 - 2014-01-21 12:09 - 01169920 ___SH () C:\Users\Christina\Desktop\Thumbs.db
2014-11-23 21:31 - 2012-07-26 08:21 - 01611993 _____ () C:\Windows\setupact.log
2014-11-23 12:33 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\NDF
2014-11-23 11:35 - 2014-01-05 20:28 - 00002285 _____ () C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2014-11-23 00:44 - 2014-01-04 17:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-21 20:16 - 2014-10-19 13:20 - 00000000 ____D () C:\Users\Christina\Desktop\Fortbildung Hydrogeologie
2014-11-21 08:40 - 2014-01-08 12:42 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-11-17 22:59 - 2014-10-16 10:50 - 00000000 ____D () C:\ProgramData\Package Cache
2014-11-17 22:59 - 2014-02-23 15:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-11-17 22:59 - 2014-02-23 15:36 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-11-17 22:51 - 2014-07-21 12:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ___RD () C:\Windows\ToastData
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Windows Defender
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-11-17 22:50 - 2014-01-05 23:24 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-17 22:47 - 2014-01-05 23:24 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-17 10:39 - 2014-06-04 14:24 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-11-14 12:22 - 2014-01-08 10:12 - 00000000 ____D () C:\Users\Christina\AppData\Local\Akamai
2014-11-07 22:50 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-11-07 20:30 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\WinStore
2014-11-06 21:53 - 2014-03-07 23:05 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-11-06 21:53 - 2014-03-07 23:05 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-11-06 21:53 - 2014-01-04 18:27 - 00000000 ____D () C:\ProgramData\Skype
2014-10-30 12:25 - 2014-02-23 13:24 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Files to move or delete:
====================
C:\Users\Christina\SETUP.EXE


Some content of TEMP:
====================
C:\Users\Christina\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-24 13:55

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-11-2014
Ran by Christina at 2014-11-26 14:01:22
Running from C:\Users\Christina\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 clear.fi SDK - Video 2 (x32 Version: 2.1.2606 - CyberLink Corp.) Hidden
 clear.fi SDK- Movie 2 (x32 Version: 2.1.2606 - CyberLink Corp.) Hidden
Acer Games (HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Pokki_03d432a7e610c3e908213e7689d4342ce2111caf) (Version: 1.1.7.42206 - Pokki)
Acer Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.3004 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3012 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3016 - Acer Incorporated)
Acer USB Charge Manager (HKLM\...\{07E867C5-0C48-40FF-A013-DDAF4565AD47}) (Version: 2.00.3004 - Acer Incorporated)
AcerCloud Docs (HKLM-x32\...\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.01.2008 - Acer Incorporated)
AcerCloud Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 2.02.2022 - Acer Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Akamai) (Version:  - Akamai Technologies, Inc)
Anno 2070 (HKLM-x32\...\Steam App 48240) (Version:  - BlueByte)
ArcGIS 10.2.2 Desktop Tutorial Data (HKLM-x32\...\ArcGIS 10.2.2 Desktop Tutorial Data) (Version: 10.2.3552 - Environmental Systems Research Institute, Inc.)
ArcGIS 10.2.2 Desktop Tutorial Data (x32 Version: 10.2.3552 - Environmental Systems Research Institute, Inc.) Hidden
ArcGIS 10.2.2 for Desktop - Sprachpaket Deutsch (HKLM-x32\...\ArcGIS 10.2.2 for Desktop - Sprachpaket Deutsch) (Version: 10.2.3552 - Environmental Systems Research Institute, Inc.)
ArcGIS 10.2.2 for Desktop - Sprachpaket Deutsch (x32 Version: 10.2.3552 - Environmental Systems Research Institute, Inc.) Hidden
ArcGIS 10.2.2 for Desktop (HKLM-x32\...\ArcGIS 10.2.2 for Desktop) (Version: 10.2.3552 - Environmental Systems Research Institute, Inc.)
ArcGIS 10.2.2 for Desktop (x32 Version: 10.2.3552 - Environmental Systems Research Institute, Inc.) Hidden
Ask Toolbar (HKLM-x32\...\{4F524A2D-5637-4300-76A7-A758B70C0A00}) (Version: 12.10.0.19 - APN, LLC) <==== ATTENTION
Avira (HKLM-x32\...\{9480d4af-12b9-4e56-8034-4031ef6ab39d}) (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.342 - Avira)
Avira Savings Advisor (HKLM-x32\...\{A18A516C-AA41-46A9-92DB-60208917E442}) (Version: 1.5.14 - Avira) <==== ATTENTION
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Call of Duty: Black Ops II - Multiplayer (HKLM-x32\...\Steam App 202990) (Version:  - )
clear.fi Media (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.02.2012 - Acer Incorporated)
clear.fi Photo (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 2.02.2016 - Acer Incorporated)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)
doPDF 7.3 printer (HKLM\...\doPDF 7 printer_is1) (Version: 7.3.398 - Softland)
Dragon Age: Origins - Ultimate Edition (HKLM-x32\...\Steam App 47810) (Version:  - BioWare)
Dragon Age: Origins (HKLM-x32\...\Steam App 17450) (Version:  - BioWare)
Free YouTube to MP3 Converter version 3.12.50.1111 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.50.1111 - DVDVideoSoft Ltd.)
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Grapher 8 Client (HKLM-x32\...\Grapher8ClientInstaller49) (Version: 8.0.0.0 - Golden Software, Inc.)
Host App Service (HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Pokki) (Version: 0.269.4.112 - Pokki)
HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version:  - )
Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.3006 - Acer Incorporated)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.0.1428 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3165 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.5.0.1066 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.63463 - Intel Corporation)
IsoBuster 3.3 (HKLM-x32\...\IsoBuster3_is1) (Version: 3.3 - Smart Projects)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.710 - Oracle)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Kingdoms of Amalur: Reckoning™ (HKLM-x32\...\Steam App 102500) (Version:  - Big Huge Games)
Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.3010 - Acer Incorporated)
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Microsoft Age of Empires Gold (HKLM-x32\...\Age of Empires Gold 1.0) (Version:  - )
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4667.1002 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 33.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Nero BackItUp 12 Essentials OEM.a01 (HKLM-x32\...\{4CA8F973-6377-4ABF-9ED5-CC2323B3C000}) (Version: 12.5.00500 - Nero AG)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.7.0.24 - Symantec Corporation)
Norton Online Backup ARA (x32 Version: 4.3.0.14 - Symantec Corporation) Hidden
NVIDIA Grafiktreiber 311.41 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.41 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.1031 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4667.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4667.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4667.1002 - Microsoft Corporation) Hidden
Office Addin (HKLM-x32\...\{6D2BBE1D-E600-4695-BA37-0B0E605542CC}) (Version: 2.02.2008 - Acer)
Opera Stable 20.0.1387.82 (HKLM-x32\...\Opera 20.0.1387.82) (Version: 20.0.1387.82 - Opera Software ASA)
Optimizer Pro v3.2 (HKLM-x32\...\Optimizer Pro v3.2_is1) (Version: 3.2.0.3 - PC Utilities Software Limited) <==== ATTENTION
Origin (HKLM-x32\...\Origin) (Version: 9.4.7.2799 - Electronic Arts, Inc.)
PDF Split And Merge Basic (HKLM\...\{9A40D2F8-9458-458B-95E3-B57797C574E1}) (Version: 2.2.3 - Andrea Vacondio)
PDF24 Creator 6.5.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Pokki Start Menu (HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Pokki_Start_Menu) (Version: 0.269.4.112 - Pokki)
Prerequisite installer (x32 Version: 12.0.0003 - Nero AG) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.222 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 11.43 - Qualcomm Atheros)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.14.327.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6909 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C9661090-C134-46E8-90B2-76D72355C2A6}) (Version: 6.2.9200.21222 - Realtek Semiconductor Corp.)
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.18.20.209 - Search Protect) <==== ATTENTION
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Smart File Advisor 1.2.0 (HKLM-x32\...\Smart File Advisor_is1) (Version: 1.2.0 - Filefacts.net)
Spotify (HKLM-x32\...\Spotify) (Version: 0.8.4.99.ga249b5f1 - Spotify AB)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.3.12.31 - Synaptics Incorporated)
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
WEB.DE MailCheck für Mozilla Firefox (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar FF) (Version: 3.0.1.1739 - 1&1 Mail & Media GmbH)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (x32 Version: 4.0.10.5 - WildTangent) Hidden
Yahoo Community Smartbar (HKLM-x32\...\{D62304BE-D5D3-4CCF-8973-123909491ADB}) (Version: 11.62.66.17712 - Linkury Inc.) <==== ATTENTION
Yahoo Community Smartbar Engine (HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\{e29211ee-48d2-4b19-8d9c-e76f140e139b}) (Version: 10.201.66.14591 - Linkury Inc.) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2103582913-709214951-153368262-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Christina\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2103582913-709214951-153368262-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Christina\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2103582913-709214951-153368262-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Christina\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2103582913-709214951-153368262-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Christina\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

04-11-2014 08:05:11 Geplanter Prüfpunkt
14-11-2014 10:44:21 Windows Update
17-11-2014 21:46:58 Windows Update
21-11-2014 10:34:47 Windows Update
26-11-2014 09:54:14 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0600FC9C-DF9D-41A1-96F6-ACEC785060EB} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2013-01-23] (Acer Incorporated)
Task: {45CEEC68-2E0D-4441-8B5D-189BE8B845DA} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2013-01-18] (Acer Incorporated)
Task: {4CADE92D-7ABC-45F7-99AD-A1B10EF79E1A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-25] (Adobe Systems Incorporated)
Task: {632E50A9-4DA2-4F32-A433-198BE1EAF185} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro 3.11\OptProLauncher.exe [2014-11-20] (PC Utilities Software Limited) <==== ATTENTION
Task: {819C0E6B-C399-4A1D-91F4-837AC730F658} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2013-01-22] ()
Task: {9E93266C-7BED-40CE-884A-8A72EFB2364B} - System32\Tasks\aviraSWU => Cscript.exe "C:\Program Files (x86)\avira\Internet Explorer\swu.vbs"
Task: {A4B456F7-F527-423D-89FD-08DEDEE54244} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2013-03-13] ()
Task: {A586A342-A4B5-445B-A147-BF6A6D28B54F} - System32\Tasks\Dolby Selector => C:\Dolby PCEE4\pcee4.exe [2012-08-31] (Dolby Laboratories Inc.)
Task: {CF306708-B0A1-4513-BF16-E671F7595AD9} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-10-22] (Microsoft Corporation)
Task: {D5B05EAF-CE6E-4E77-881B-900DE09B7B70} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-10-07] (Microsoft Corporation)
Task: {D727F8AA-67AA-401F-B38A-7B6A6D4AAAE8} - System32\Tasks\Launch Manager => C:\Program Files\Acer\Acer Launch Manager\LMLauncher.exe [2013-04-26] (Acer Incorporate)
Task: {DEDF61C9-D84A-47D0-931E-D020738F34D4} - System32\Tasks\Norton Online Backup ARA => C:\Program Files (x86)\Norton Online Backup ARA\Engine\4.3.0.14\\Ara.exe [2013-08-27] (Symantec Corporation)
Task: {FF453F47-2E8F-4D8E-861C-6B171FF15C36} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-11-17] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-08-29 13:17 - 2012-08-31 14:03 - 00288768 _____ () C:\Windows\System32\HP1100LM.DLL
2014-08-29 13:16 - 2012-08-31 14:02 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1100PP.DLL
2014-04-12 02:16 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-05-15 12:26 - 2014-05-15 12:26 - 00176048 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll
2013-02-28 18:05 - 2013-02-28 18:05 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-02-28 18:02 - 2013-02-28 18:02 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-02-28 18:06 - 2013-02-28 18:06 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2014-08-29 13:15 - 2012-08-31 14:03 - 03034112 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\hp1100su.dll
2014-08-29 13:15 - 2012-08-31 14:02 - 01038336 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\HP1100GC.dll
2014-08-29 13:15 - 2012-08-31 14:03 - 00373760 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\hp1100sd.dll
2014-10-02 19:07 - 2014-10-02 19:07 - 00569856 _____ () C:\Users\Christina\AppData\Local\Pokki\Engine\ppGoogleNaClPluginChrome.dll
2014-10-02 19:07 - 2014-10-02 19:07 - 01400846 _____ () C:\Users\Christina\AppData\Local\Pokki\Engine\avcodec-54.dll
2014-10-02 19:07 - 2014-10-02 19:07 - 00151054 _____ () C:\Users\Christina\AppData\Local\Pokki\Engine\avutil-51.dll
2014-10-02 19:07 - 2014-10-02 19:07 - 00222734 _____ () C:\Users\Christina\AppData\Local\Pokki\Engine\avformat-54.dll
2013-11-13 11:14 - 2013-03-20 08:47 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-11-10 22:54 - 2014-11-10 22:54 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2006-10-26 13:56 - 2006-10-26 13:56 - 00757008 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
2014-01-08 12:51 - 2014-01-08 12:51 - 00038112 _____ () C:\Users\Christina\AppData\Local\assembly\dl3\P1BT2A39.2T5\J81W57RD.PZR\e3063738\008ce165_b4dfcd01\WordAddIn.DLL
2013-11-13 11:57 - 2013-02-20 22:58 - 00089672 _____ () C:\Program Files (x86)\Acer\clear.fi plug-in\Clearfishellext.dll
2012-09-23 20:43 - 2012-09-23 20:43 - 00313992 _____ () C:\Program Files (x86)\Adobe\Reader 11.0\Reader\sqlite.dll
2013-09-05 15:04 - 2013-09-05 15:04 - 14588632 _____ () C:\Program Files (x86)\Adobe\Reader 11.0\Reader\NPSWF32.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "ApnTBMon"
HKLM\...\StartupApproved\Run32: => "Smart File Advisor"
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\StartupApproved\Run: => "Browser Infrastructure Helper"
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\StartupApproved\Run: => "EADM"

========================= Accounts: ==========================

Administrator (S-1-5-21-2103582913-709214951-153368262-500 - Administrator - Disabled)
Christina (S-1-5-21-2103582913-709214951-153368262-1002 - Administrator - Enabled) => C:\Users\Christina
Gast (S-1-5-21-2103582913-709214951-153368262-501 - Limited - Disabled)
UpdatusUser (S-1-5-21-2103582913-709214951-153368262-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============

Name: Bluetooth USB Module
Description: Bluetooth USB Module
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/26/2014 10:33:04 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (11/26/2014 09:57:11 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161

Error: (11/25/2014 00:40:28 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (11/25/2014 10:51:01 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161

Error: (11/24/2014 07:35:00 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll8

Error: (11/24/2014 07:35:00 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: MSDTCC:\Windows\system32\msdtcuiu.DLL8

Error: (11/24/2014 07:35:00 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: LsaC:\Windows\System32\Secur32.dll8

Error: (11/24/2014 07:35:00 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: ESENTC:\Windows\system32\esentprf.dll8

Error: (11/24/2014 07:35:00 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (11/24/2014 07:35:00 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\Windows\system32\mscoree.dll8


System errors:
=============
Error: (11/26/2014 10:56:35 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "McAfee AP Service" ist von folgendem Dienst abhängig: mfevtp. Dieser Dienst ist möglicherweise nicht installiert.

Error: (11/23/2014 00:34:34 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "MYNETN600",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DD79CDE2-EF88-4007-A109-E2F227D6BD47}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/23/2014 00:11:21 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "MYNETN600",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DD79CDE2-EF88-4007-A109-E2F227D6BD47}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/23/2014 11:37:26 AM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "MYNETN600",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DD79CDE2-EF88-4007-A109-E2F227D6BD47}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/23/2014 00:44:57 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "McAfee AP Service" ist von folgendem Dienst abhängig: mfevtp. Dieser Dienst ist möglicherweise nicht installiert.

Error: (11/22/2014 09:13:33 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "MYNETN600",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DD79CDE2-EF88-4007-A109-E2F227D6BD47}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/22/2014 09:08:04 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "MYNETN600",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DD79CDE2-EF88-4007-A109-E2F227D6BD47}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/22/2014 03:39:35 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "MYNETN600",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DD79CDE2-EF88-4007-A109-E2F227D6BD47}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/22/2014 00:19:54 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "MYNETN600",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DD79CDE2-EF88-4007-A109-E2F227D6BD47}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/21/2014 08:36:08 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "MYNETN600",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DD79CDE2-EF88-4007-A109-E2F227D6BD47}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-4200U CPU @ 1.60GHz
Percentage of memory in use: 41%
Total physical RAM: 8072.27 MB
Available physical RAM: 4733.14 MB
Total Pagefile: 10632.27 MB
Available Pagefile: 6908.98 MB
Total Virtual: 8192 MB
Available Virtual: 8191.77 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:449.51 GB) (Free:260.71 GB) NTFS
Drive d: (OFFICE12) (CDROM) (Total:0.56 GB) (Free:0 GB) CDFS
Drive e: (SAMSUNG) (Fixed) (Total:596 GB) (Free:327.96 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: D77D5BBC)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 596.2 GB) (Disk ID: D340FE79)
Partition 1: (Active) - (Size=596.2 GB) - (Type=0C)

==================== End Of Log ============================
__________________
Alt 27.11.2014, 09:21   #4
Warlord711
/// TB-Ausbilder
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    • Ask Toolbar
    • Avira Savings Advisor
    • Optimizer Pro v3.2
    • Search Protect
    • Yahoo Community Smartbar

  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 




Unsere eingesetzten Werkzeuge entfernen Malware und AdWare automatisch, somit auch die "Zwangs-Adware" von Avira.

Deswegen kann es sein, das Avira nach der Bereinigung nicht mehr korrekt funktioniert, u.a. der Browserschutz, der nur mit installierter AdWare funktioniert.




Der folgende Abschnitt ist meine persönliche Meinung

Du hast Avira Free als Virenschutz installiert und das ist "leider" ein zweischneidiges Schwert.

Zum einen ist es ein Virenschutz, zum anderen Adware, denn die Free Version von Avira bringt die AskToolbar mit, ohne die der Surfschutz nicht funktioniert.

Deswegen würde ich dir "persönlich" ein anderes Produkt empfehlen.

Als kostenlose Alternative nenne ich:


Schritt 1

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 2

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.



Schritt 3

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.



Schritt 4

Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.
__________________
Lerne, zurück zu schlagen und unterstütze uns!
TB Akademie | Spende | Lob & Kritik

Alt 27.11.2014, 15:24   #5
Katzenauge88
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v4.102 - Bericht erstellt am 27/11/2014 um 12:32:05
# Aktualisiert 23/11/2014 von Xplode
# Database : 2014-11-27.1 [Live]
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : Christina - VFL1900
# Gestartet von : C:\Users\Christina\Downloads\AdwCleaner_4.102.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\Pokki
Ordner Gelöscht : C:\Users\Christina\AppData\Local\LPT
Ordner Gelöscht : C:\Users\Christina\AppData\Local\Pokki
Ordner Gelöscht : C:\Users\Christina\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\CHRIST~1\AppData\Local\Temp\Smartbar
Ordner Gelöscht : C:\Users\Christina\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Users\Christina\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Christina\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Christina\AppData\Roaming\RHEng
Ordner Gelöscht : C:\Users\Christina\Documents\Optimizer Pro
Ordner Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\searchplugins\bingp.xml
Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\searchplugins\trovi-search.xml
Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\searchplugins\Web Search.xml

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Classes\pokki
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Pokki]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKCU\Software\Classes\AllFileSystemObjects\shell\pokki
Schlüssel Gelöscht : HKCU\Software\Classes\Directory\shell\pokki
Schlüssel Gelöscht : HKCU\Software\Classes\Drive\shell\pokki
Schlüssel Gelöscht : HKCU\Software\Classes\lnkfile\shell\pokki
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{4E71C441-AC1E-4B9B-9BEE-C67F9FE3AF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\Pokki
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\smartbarbackup
Schlüssel Gelöscht : HKCU\Software\smartbarlog
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.17148

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

-\\ Mozilla Firefox v33.1 (x86 de)

[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.defaultenginename", "Web Search");
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.selectedEngine", "Web Search");
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb4G4avepFD7B7tQI75duRaUfZXHf1FSQyNBVfTAXBd1a-J_dVGzOLjDonrTfLtbBMfGyirXNvH[...]
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.DockingPositionDown", false);
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", false);
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.Visibility", true);
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.countryiso", "de");
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.downloadprovider", "yahoooc");
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.externalJsFiles", "{\"d\":\"[{\\\"ExcludeDomains\\\":[\\\"snap.do\\\",\\\"snapdo.com\\\"],\\\"hxxpInjection\\\":\\\"hxxp:\\\\\\/\\\\\\/i.linkuryjs.info\\\\\\/kury\\\\\\[...]
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.installationid", "70261997-9771-8376-170f-4d937b72195f");
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.installdate", "09/02/2014");
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.lastExternalJsUpdate", "1392463288566");
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.publisher", "yahoooc");
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.type", "hp1000");
[xo53irn6.default\prefs.js] - Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb4G4avepFD7B7tQI75duRaUfZXHf1FSQyNBVfTAXBd1a-J_dVGzOLjDonrTfLtbBMTxcZGNvWHWywFGDI3W3KuF[...]

-\\ Opera v20.0.1387.82


*************************

AdwCleaner[R0].txt - [13670 octets] - [27/11/2014 12:30:50]
AdwCleaner[S0].txt - [10985 octets] - [27/11/2014 12:32:05]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [11046 octets] ##########
--- --- ---


JRT Logfile:
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.9 (11.15.2014:2)
OS: Windows 8 x64
Ran by Christina on 27.11.2014 at 13:42:06,78
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\ammyy"



~~~ FireFox

Successfully deleted: [Folder] C:\Users\Christina\AppData\Roaming\mozilla\firefox\profiles\xo53irn6.default\extensions\toolbar@web.de
Successfully deleted the following from C:\Users\Christina\AppData\Roaming\mozilla\firefox\profiles\xo53irn6.default\prefs.js

user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-
Emptied folder: C:\Users\Christina\AppData\Roaming\mozilla\firefox\profiles\xo53irn6.default\minidumps [13 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.11.2014 at 13:45:46,55
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--- --- ---

Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org


Protection, 27.11.2014 13:55:37, SYSTEM, VFL1900, Protection, Malware Protection, Starting, 
Protection, 27.11.2014 13:55:37, SYSTEM, VFL1900, Protection, Malware Protection, Started, 
Protection, 27.11.2014 13:55:37, SYSTEM, VFL1900, Protection, Malicious Website Protection, Starting, 
Protection, 27.11.2014 13:55:37, SYSTEM, VFL1900, Protection, Malicious Website Protection, Started, 
Update, 27.11.2014 13:55:39, SYSTEM, VFL1900, Manual, Rootkit Database, 2014.9.18.1, 2014.11.22.1, 
Update, 27.11.2014 13:55:42, SYSTEM, VFL1900, Manual, Malware Database, 2014.9.19.5, 2014.11.27.5, 
Protection, 27.11.2014 13:55:42, SYSTEM, VFL1900, Protection, Refresh, Starting, 
Protection, 27.11.2014 13:55:42, SYSTEM, VFL1900, Protection, Malicious Website Protection, Stopping, 
Protection, 27.11.2014 13:55:42, SYSTEM, VFL1900, Protection, Malicious Website Protection, Stopped, 
Protection, 27.11.2014 13:55:46, SYSTEM, VFL1900, Protection, Refresh, Success, 
Protection, 27.11.2014 13:55:46, SYSTEM, VFL1900, Protection, Malicious Website Protection, Starting, 
Protection, 27.11.2014 13:55:46, SYSTEM, VFL1900, Protection, Malicious Website Protection, Started, 
Scan, 27.11.2014 15:14:01, SYSTEM, VFL1900, Manual, Start: % 1 "% 2", Dauer: % 1 min 23 Sekunden, Bedrohungs-Suchlauf, Abgeschlossen, 2 Malwareerkennung, 30-Malwareerkennung, 
Protection, 27.11.2014 15:15:44, SYSTEM, VFL1900, Protection, Malware Protection, Starting, 
Protection, 27.11.2014 15:15:44, SYSTEM, VFL1900, Protection, Malware Protection, Started, 
Protection, 27.11.2014 15:15:44, SYSTEM, VFL1900, Protection, Malicious Website Protection, Starting, 
Protection, 27.11.2014 15:16:58, SYSTEM, VFL1900, Protection, Malicious Website Protection, Started, 

(end)

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-11-2014 01
Ran by Christina (administrator) on VFL1900 on 27-11-2014 15:23:14
Running from C:\Users\Christina\Downloads
Loaded Profiles: UpdatusUser & Christina (Available profiles: UpdatusUser & Christina)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Akamai Technologies, Inc.) C:\Users\Christina\AppData\Local\Akamai\netsession_win.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Akamai Technologies, Inc.) C:\Users\Christina\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13538376 2013-05-13] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1307720 2013-04-24] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3016432 2013-03-07] (Synaptics Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Smart File Advisor] => C:\Program Files (x86)\Smart File Advisor\sfa.exe [283712 2013-11-26] (Filefacts.net)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-06-04] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132224 2013-02-28] ( (Atheros Communications))
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1940160 2014-11-18] (Valve Corporation)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [Akamai NetSession Interface] => C:\Users\Christina\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3600216 2014-10-11] (Electronic Arts)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\RunOnce: [Application Restart #1] => C:\Users\Christina\AppData\Local\Pokki\Engine\pokki.exe  --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-s (the data entry has 548 more characters).
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\RunOnce: [Application Restart #0] => C:\Users\Christina\AppData\Local\Pokki\Engine\HostAppService.exe  --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable (the data entry has 557 more characters).
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\MountPoints2: {1f037c66-3c1c-11e4-be8d-78843c345e4f} - "F:\Startme.exe" 
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\MountPoints2: {fe31343b-8dcd-11e3-be7b-78843c345e4f} - "D:\SETUP.EXE" 
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\MountPoints2: {feb1c31a-26f2-11e4-be8b-78843c345e4f} - "E:\SISetup.exe" 
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [245872 2013-03-07] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [201576 2013-03-07] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2103582913-709214951-153368262-1001\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-2103582913-709214951-153368262-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
HKU\S-1-5-21-2103582913-709214951-153368262-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKLM -> DefaultScope {7C4BC3F2-9BB5-4B11-AE8E-120F2AA7869E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM -> {7C4BC3F2-9BB5-4B11-AE8E-120F2AA7869E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = 
SearchScopes: HKU\S-1-5-21-2103582913-709214951-153368262-1002 -> DefaultScope {7C4BC3F2-9BB5-4B11-AE8E-120F2AA7869E} URL = 
SearchScopes: HKU\S-1-5-21-2103582913-709214951-153368262-1002 -> {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-iobit
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF SearchEngineOrder.3: Bing 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.20 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2103582913-709214951-153368262-1002: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: Avira Browser Safety - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\Extensions\abs@avira.com [2014-11-19]
FF Extension: Download videos and MP3s from YouTube - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-11-24]
FF Extension: UITBAutoInstaller - C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\{edd7fc99-d65c-4979-85c2-ddeed30c50c7} [2014-11-24]
FF HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-24]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-11-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-18] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [227968 2013-02-28] (Qualcomm Atheros Commnucations)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2615368 2013-02-27] (Acer Incorporated)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2443960 2014-10-30] (Microsoft Corporation)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [660040 2013-01-18] (Acer Incorporated)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-03-20] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-20] (Intel Corporation)
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [431656 2013-04-26] (Acer Incorporate)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
S3 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [4230016 2013-01-28] (Symantec Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16032 2014-09-22] (Microsoft Corporation)
S2 51cdb72; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro 3.11\OptProCrash.dll",ENT
S2 McAPExe; "C:\Program Files\McAfee\MSC\McAPExe.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-02-28] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0403000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-02-09] (Disc Soft Ltd)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-01-10] (Acer Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-27] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-03-20] (Intel Corporation)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)
S3 QRDCIO; C:\Windows\System32\drivers\QRDCIO.sys [9728 2009-10-20] (QUANTA)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [15704 2013-01-10] (Acer Incorporated)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [455240 2013-03-05] (RTS Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31984 2013-03-07] (Synaptics Incorporated)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-27 15:23 - 2014-11-27 15:23 - 02117632 _____ (Farbar) C:\Users\Christina\Downloads\FRST64.exe
2014-11-27 15:23 - 2014-11-27 15:23 - 00018778 _____ () C:\Users\Christina\Downloads\FRST.txt
2014-11-27 15:23 - 2014-11-27 15:23 - 00000000 ____D () C:\Users\Christina\Downloads\FRST-OlderVersion
2014-11-27 15:21 - 2014-11-27 15:21 - 00001806 _____ () C:\Users\Christina\Desktop\mbam.txt
2014-11-27 13:55 - 2014-11-27 15:17 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-27 13:55 - 2014-11-27 13:55 - 00001122 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-11-27 13:55 - 2014-11-27 13:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-11-27 13:55 - 2014-11-27 13:55 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-27 13:55 - 2014-11-27 13:55 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-11-27 13:55 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-27 13:55 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-27 13:55 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-27 13:54 - 2014-11-27 13:54 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Christina\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-27 13:45 - 2014-11-27 13:45 - 00001250 _____ () C:\Users\Christina\Desktop\JRT.txt
2014-11-27 13:42 - 2014-11-27 13:42 - 00000000 ____D () C:\Windows\ERUNT
2014-11-27 13:41 - 2014-11-27 13:41 - 01707532 _____ (Thisisu) C:\Users\Christina\Downloads\JRT.exe
2014-11-27 12:29 - 2014-11-27 12:33 - 00000000 ____D () C:\AdwCleaner
2014-11-27 12:28 - 2014-11-27 12:28 - 02148864 _____ () C:\Users\Christina\Downloads\AdwCleaner_4.102.exe
2014-11-27 12:11 - 2014-11-27 12:11 - 00000000 ____D () C:\Users\Christina\Downloads\RevoUninstallerPortable
2014-11-27 12:10 - 2014-11-27 12:10 - 02785665 _____ (PortableApps.com) C:\Users\Christina\Downloads\RevoUninstallerPortable_1.95_Rev_2.paf.exe
2014-11-26 14:01 - 2014-11-26 14:02 - 00028376 _____ () C:\Users\Christina\Downloads\Addition.txt
2014-11-26 13:59 - 2014-11-27 15:23 - 00000000 ____D () C:\FRST
2014-11-26 13:33 - 2014-11-19 08:29 - 00582552 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe
2014-11-26 13:33 - 2014-11-19 08:29 - 00462760 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-11-26 10:54 - 2014-11-20 21:56 - 00713672 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-26 10:54 - 2014-11-20 21:56 - 00106440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-26 10:06 - 2014-11-26 10:06 - 00000131 _____ () C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\IObit Freeware.url
2014-11-26 10:06 - 2014-11-26 10:06 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-11-26 10:03 - 2014-11-26 10:03 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\TeamViewer
2014-11-26 10:03 - 2014-11-26 10:03 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-11-25 12:25 - 2014-11-25 12:25 - 02280510 _____ () C:\Users\Christina\Downloads\Maize.crop.calendar.fill.tar.gz
2014-11-24 16:25 - 2014-11-24 16:25 - 01169232 _____ () C:\Users\Christina\Downloads\wmp81n - CHIP-Installer.exe
2014-11-24 16:23 - 2014-11-24 16:23 - 01169232 _____ () C:\Users\Christina\Downloads\Windows Media Player - CHIP-Installer(1).exe
2014-11-24 16:22 - 2014-11-24 16:22 - 01169232 _____ () C:\Users\Christina\Downloads\Windows Media Player - CHIP-Installer.exe
2014-11-24 12:22 - 2014-11-24 12:22 - 00000000 ____D () C:\Program Files (x86)\WEB.DE MailCheck
2014-11-24 12:21 - 2014-11-24 12:22 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\DVDVideoSoft
2014-11-24 12:21 - 2014-11-24 12:21 - 00001536 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2014-11-24 12:21 - 2014-11-24 12:21 - 00001243 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-11-24 12:21 - 2014-11-24 12:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-11-24 12:21 - 2014-11-24 12:21 - 00000000 ____D () C:\Program Files (x86)\Free Codec Pack
2014-11-24 12:21 - 2014-11-24 12:21 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-11-24 12:16 - 2014-11-24 12:17 - 34667648 _____ (DVDVideoSoft Ltd. ) C:\Users\Christina\Downloads\FreeYouTubeToMP3Converter3.12.50.1111.exe
2014-11-19 23:27 - 2014-11-08 12:22 - 00238080 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-19 23:27 - 2014-11-08 12:21 - 00827904 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 23:27 - 2014-11-08 07:57 - 00187904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-19 23:27 - 2014-11-08 07:56 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-17 22:59 - 2014-11-17 22:59 - 00001141 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-11-14 00:31 - 2014-09-22 06:53 - 00035320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-11-14 00:31 - 2014-08-26 23:08 - 00270024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-11-14 00:30 - 2014-11-05 07:40 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-14 00:30 - 2014-11-05 07:38 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-14 00:30 - 2014-11-05 04:16 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-14 00:30 - 2014-10-11 08:45 - 10115072 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-11-14 00:30 - 2014-10-11 08:44 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-14 00:30 - 2014-10-11 08:44 - 00393216 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-11-14 00:30 - 2014-10-11 08:43 - 02307072 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-11-14 00:30 - 2014-10-11 06:58 - 08858624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-11-14 00:30 - 2014-10-11 06:57 - 02416640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-14 00:30 - 2014-10-11 06:57 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-11-14 00:30 - 2014-10-11 06:56 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-11-14 00:17 - 2014-10-18 09:44 - 00778240 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-14 00:17 - 2014-10-18 08:05 - 00567808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-14 00:17 - 2014-10-11 09:35 - 00171840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-14 00:17 - 2014-10-11 08:44 - 03248640 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-11-14 00:17 - 2014-10-11 08:44 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-11-14 00:17 - 2014-10-11 08:43 - 01281536 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-14 00:17 - 2014-10-11 06:57 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-11-14 00:17 - 2014-10-11 06:41 - 00713728 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-14 00:17 - 2014-10-11 06:41 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-14 00:17 - 2014-10-11 06:05 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-14 00:17 - 2014-10-11 06:04 - 00713728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-14 00:17 - 2014-10-03 02:21 - 00522728 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-14 00:17 - 2014-10-02 23:29 - 00783872 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-14 00:17 - 2014-10-02 23:29 - 00267264 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-14 00:17 - 2014-10-02 23:29 - 00169472 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2014-11-14 00:17 - 2014-10-02 00:05 - 04068864 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-14 00:17 - 2014-09-13 07:24 - 02233152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-11-14 00:17 - 2014-09-06 01:46 - 00389176 _____ () C:\Windows\system32\ApnDatabase.xml
2014-11-14 00:17 - 2014-09-03 03:48 - 00457728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2014-11-14 00:17 - 2014-09-03 03:48 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2014-11-14 00:17 - 2014-09-03 03:22 - 00188928 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2014-11-14 00:17 - 2014-09-03 03:21 - 00623104 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2014-11-14 00:17 - 2014-09-03 03:21 - 00212992 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2014-11-14 00:17 - 2014-08-29 05:17 - 02043392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-11-14 00:17 - 2014-08-29 05:17 - 00227328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-11-14 00:17 - 2014-08-29 05:04 - 02837504 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-11-14 00:17 - 2014-08-29 05:04 - 00309248 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-11-14 00:17 - 2014-08-28 07:04 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSCOMEX.dll
2014-11-14 00:17 - 2014-08-28 07:04 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSAPI.dll
2014-11-14 00:17 - 2014-08-28 06:59 - 00616448 _____ (Microsoft Corporation) C:\Windows\system32\FXSAPI.dll
2014-11-14 00:17 - 2014-08-28 06:59 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOMEX.dll
2014-11-14 00:17 - 2014-08-28 06:59 - 00432640 _____ (Microsoft Corporation) C:\Windows\system32\FXSTIFF.dll
2014-11-14 00:17 - 2014-08-28 06:59 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\FXST30.dll
2014-11-14 00:17 - 2014-07-24 14:12 - 00328512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-11-14 00:16 - 2014-10-23 13:47 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-14 00:16 - 2014-10-23 12:04 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-14 00:16 - 2014-09-25 00:29 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-14 00:16 - 2014-09-25 00:29 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptsslp.dll
2014-11-14 00:16 - 2014-09-25 00:01 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-14 00:16 - 2014-09-25 00:01 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\ncryptsslp.dll
2014-11-14 00:16 - 2014-08-22 00:56 - 01418752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-14 00:16 - 2014-08-22 00:27 - 01845760 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-14 00:15 - 2014-10-26 02:56 - 02237952 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-14 00:15 - 2014-10-26 02:56 - 01409536 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-14 00:15 - 2014-10-26 02:56 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-11-14 00:15 - 2014-10-26 02:56 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-14 00:15 - 2014-10-26 02:55 - 19284480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-14 00:15 - 2014-10-26 02:55 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-14 00:15 - 2014-10-26 02:55 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-14 00:15 - 2014-10-26 02:55 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 15399424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-11-14 00:15 - 2014-10-26 02:53 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-14 00:15 - 2014-10-26 01:36 - 01762816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 14368768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 13758464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-14 00:15 - 2014-10-26 01:34 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-11-14 00:14 - 2014-10-26 02:56 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-11-14 00:14 - 2014-10-26 02:54 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-14 00:14 - 2014-10-26 02:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-14 00:14 - 2014-10-26 02:54 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-14 00:14 - 2014-10-26 02:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-14 00:14 - 2014-10-26 01:35 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-11-14 00:14 - 2014-10-26 01:34 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-14 00:14 - 2014-10-26 01:34 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-14 00:14 - 2014-10-26 01:34 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-14 00:14 - 2014-10-26 01:34 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-14 00:14 - 2014-10-26 01:19 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-14 00:14 - 2014-10-26 01:13 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-11-14 00:14 - 2014-10-25 22:48 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-11-10 22:54 - 2014-11-24 12:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-07 20:36 - 2014-11-07 20:36 - 01054912 _____ (Adobe) C:\Users\Christina\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
2014-11-07 20:30 - 2014-11-08 22:48 - 00000000 ____D () C:\Windows\system32\AutoUpdateLicense
2014-11-06 21:53 - 2014-11-06 21:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-11-05 11:10 - 2014-11-05 11:10 - 00000000 ____D () C:\Users\Christina\AppData\Local\ArcGISRuntime
2014-11-04 10:11 - 2014-11-04 10:20 - 00000000 ____D () C:\Users\Christina\Desktop\Singen
2014-11-04 08:52 - 2014-11-04 08:53 - 00013904 _____ () C:\Users\Christina\Downloads\mapserv.exe
2014-10-29 13:02 - 2014-10-22 04:34 - 00010777 _____ () C:\Windows\system32\AutoconfigV2.cab
2014-10-29 13:02 - 2014-10-22 02:08 - 00568832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-10-29 13:02 - 2014-10-22 02:08 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-29 13:02 - 2014-10-22 02:01 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-10-29 13:02 - 2014-10-22 02:01 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2014-10-29 13:02 - 2014-10-22 02:01 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-29 13:02 - 2014-10-22 02:00 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2014-10-28 18:46 - 2014-10-28 18:46 - 00000000 ____D () C:\Users\Christina\AppData\Local\Intel_Corporation

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-27 15:22 - 2014-01-04 17:51 - 00003594 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2103582913-709214951-153368262-1002
2014-11-27 15:21 - 2013-11-13 19:52 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2014-11-27 15:21 - 2013-11-13 19:52 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2014-11-27 15:21 - 2012-07-26 08:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-27 15:15 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-27 15:14 - 2013-08-02 15:50 - 00180896 _____ () C:\Windows\PFRO.log
2014-11-27 15:14 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-11-27 15:02 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru
2014-11-27 14:32 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\NDF
2014-11-27 14:30 - 2014-07-21 12:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-27 12:28 - 2014-01-04 18:00 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-11-27 12:19 - 2014-02-23 15:36 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-11-27 12:19 - 2013-11-13 11:10 - 01144140 _____ () C:\Windows\WindowsUpdate.log
2014-11-26 20:59 - 2014-10-27 14:45 - 00000000 ____D () C:\Users\Christina\Desktop\GIS
2014-11-26 18:12 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\rescache
2014-11-26 17:02 - 2012-07-26 08:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-11-26 11:38 - 2014-03-04 14:50 - 00141968 _____ () C:\Users\Christina\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-26 11:38 - 2014-01-08 12:51 - 00000000 ____D () C:\Users\Christina\AppData\Local\Deployment
2014-11-26 10:57 - 2014-09-26 17:55 - 00002114 _____ () C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk
2014-11-26 10:56 - 2014-10-25 14:15 - 00513768 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-25 22:16 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-11-25 21:33 - 2014-07-21 12:53 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-25 18:22 - 2014-10-27 14:52 - 00000000 ____D () C:\arcgis
2014-11-25 14:27 - 2014-01-04 17:42 - 00000000 ____D () C:\Users\Christina\AppData\Local\Packages
2014-11-25 13:03 - 2014-01-04 18:28 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Skype
2014-11-23 21:33 - 2014-01-21 12:09 - 01169920 ___SH () C:\Users\Christina\Desktop\Thumbs.db
2014-11-23 21:31 - 2012-07-26 08:21 - 01611993 _____ () C:\Windows\setupact.log
2014-11-23 11:35 - 2014-01-05 20:28 - 00002285 _____ () C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2014-11-23 00:44 - 2014-01-04 17:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-21 20:16 - 2014-10-19 13:20 - 00000000 ____D () C:\Users\Christina\Desktop\Fortbildung Hydrogeologie
2014-11-21 08:40 - 2014-01-08 12:42 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-11-17 22:59 - 2014-10-16 10:50 - 00000000 ____D () C:\ProgramData\Package Cache
2014-11-17 22:59 - 2014-02-23 15:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-11-17 22:51 - 2014-07-21 12:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ___RD () C:\Windows\ToastData
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Windows Defender
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-11-17 22:50 - 2014-01-05 23:24 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-17 22:47 - 2014-01-05 23:24 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-14 12:22 - 2014-01-08 10:12 - 00000000 ____D () C:\Users\Christina\AppData\Local\Akamai
2014-11-07 22:50 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-11-07 20:30 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\WinStore
2014-11-06 21:53 - 2014-03-07 23:05 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-11-06 21:53 - 2014-03-07 23:05 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-11-06 21:53 - 2014-01-04 18:27 - 00000000 ____D () C:\ProgramData\Skype
2014-11-04 10:17 - 2014-10-27 14:45 - 00000000 ____D () C:\Users\Christina\Desktop\Sonstiges
2014-10-30 12:25 - 2014-02-23 13:24 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-29 20:22 - 2014-10-27 14:41 - 00000000 ____D () C:\Users\Christina\AppData\Local\ESRI

Files to move or delete:
====================
C:\Users\Christina\SETUP.EXE


Some content of TEMP:
====================
C:\Users\Christina\AppData\Local\Temp\avgnt.exe
C:\Users\Christina\AppData\Local\Temp\Quarantine.exe
C:\Users\Christina\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-24 13:55

==================== End Of Log ============================
--- --- ---

--- --- ---


Alt 28.11.2014, 11:16   #6
Warlord711
/// TB-Ausbilder
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Falsches Malwarebytes Log. Bitte das SUCHLAUF Protokoll posten.

Optimizer Pro - hast du den deinstalliert ?
Sagt dir der UITBAutoInstaller etwas ?

Ansonsten diesen Fix ausführen:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Extension: UITBAutoInstaller - C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\{edd7fc99-d65c-4979-85c2-ddeed30c50c7} [2014-11-24]
S2 51cdb72; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro 3.11\OptProCrash.dll",ENT

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.

__________________
--> Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC
Geändert von Warlord711 (28.11.2014 um 11:29 Uhr)

Alt 28.11.2014, 12:27   #7
Katzenauge88
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Hey, Ja keine Ahnung warum ich das falsche Logfile hatte, hier das müsste das richtige sein!
Optimizer Pro hatte ich deinstalliert...und UITBAutoInstaller sagt mir nichts...was auch immer mir das sagen sollt
also werde ich mal den Fix ausführen und dann nochmal den FRST Scan txt posten.

Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 27.11.2014
Suchlauf-Zeit: 14:46:18
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.3.1025
Malware Datenbank: v2014.11.27.05
Rootkit Datenbank: v2014.11.22.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8
CPU: x64
Dateisystem: NTFS
Benutzer: Christina

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 373633
Verstrichene Zeit: 23 Min, 48 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 1
PUP.Optional.Snapdo.T, HKU\S-1-5-21-2103582913-709214951-153368262-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, Löschen bei Neustart, [13ae60e06418122429456797cb37db25], 

Registrierungswerte: 1
PUP.Optional.Snapdo.T, HKU\S-1-5-21-2103582913-709214951-153368262-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {006ee092-9658-4fd6-bd8e-a21a348e59f5}, Löschen bei Neustart, [6c551828ff7da195274d6bebbe450bf5]

Registrierungsdaten: 6
PUP.Optional.HelperBar.A, HKU\S-1-5-21-2103582913-709214951-153368262-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000),Löschen bei Neustart,[0eb31c24e39938fea66d9cb2ec19e31d]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-2103582913-709214951-153368262-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=hp&fr=linkury-tb&installDate=09/02/2014&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=hp&fr=linkury-tb&installDate=09/02/2014&type=hp1000),Löschen bei Neustart,[e5dcb28e4b31033383919db1a3629868]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-2103582913-709214951-153368262-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000),Löschen bei Neustart,[526f2a165c2090a60a087cd2b055c33d]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-2103582913-709214951-153368262-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000),Löschen bei Neustart,[18a98db3acd0cd69b65fd6788d7834cc]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-2103582913-709214951-153368262-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000),Löschen bei Neustart,[1ba6e45c295348ee3adcfc52dc29b947]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-2103582913-709214951-153368262-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=70261997-9771-8376-170f-4d937b72195f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=09/02/2014&type=hp1000),Löschen bei Neustart,[f3cea69a0676989eb55c6ce2689d46ba]

Ordner: 1
Rogue.Multiple, C:\ProgramData\600440862, In Quarantäne, [3b8600403e3e989e2eebe8171de5a957], 

Dateien: 23
PUP.Optional.Conduit.A, C:\Windows\Temp\nsn76BA.exe, In Quarantäne, [863bf7493d3fda5c6c7accd1946d639d], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsp16D2.exe, In Quarantäne, [a91861dfa4d8a1957670ebb2bc4510f0], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsp4255.exe, In Quarantäne, [e0e196aad9a34ceaca1c514cad54a858], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nst376B.exe, In Quarantäne, [c00150f07ffd23131cca455819e8da26], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsu7456.exe, In Quarantäne, [6f527dc36913fe38da0ccbd2c33e5fa1], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsu920F.exe, In Quarantäne, [ebd67ac6443845f196506d30f70ac43c], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsuC45C.exe, In Quarantäne, [d9e8eb55661660d68b5b514c6f92de22], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsw9FE7.exe, In Quarantäne, [ebd694acafcd4fe72bbb7429669bb44c], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsxE514.exe, In Quarantäne, [08b96ad6f4881b1b91554e4f15ec1ce4], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsm4D48.exe, In Quarantäne, [c5fc75cb681415212eb8930af50c8878], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsdD3BD.exe, In Quarantäne, [21a0f749b7c5be78d0168914679a0cf4], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsdEEF8.exe, In Quarantäne, [d3eef24e601c6acc29bd089542bfc43c], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsfB0F1.exe, In Quarantäne, [49781927324a45f176703b62f40d37c9], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsjB122.exe, In Quarantäne, [dfe29fa1e5975cdae4023f5ec9387a86], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nsjBE23.exe, In Quarantäne, [5a678eb22656c0768b5bf6a78b76b34d], 
PUP.Optional.Conduit.A, C:\Windows\Temp\nslCD34.exe, In Quarantäne, [f7caf24ec6b656e025c13e5f49b87090], 
PUP.Optional.OpenCandy, C:\Users\Christina\Downloads\DTLite4481-0347.exe, In Quarantäne, [a8195be5225ae650f9ed7a030ef7a55b], 
PUP.Optional.Softonic.A, C:\Users\Christina\Downloads\SoftonicDownloader_fuer_age-of-empires-iii(1).exe, In Quarantäne, [49782c143f3dca6c282789b21ee3d42c], 
PUP.Optional.Softonic.A, C:\Users\Christina\Downloads\SoftonicDownloader_fuer_age-of-empires-iii.exe, In Quarantäne, [338e40004537f640a6a9dc5fd1301ae6], 
PUP.Optional.SnapDo.A, C:\Windows\Installer\3e6f75a.msi, In Quarantäne, [9031a898334968ce252b38679c6521df], 
PUP.Optional.SnapDo.A, C:\Windows\Installer\3e6facd.msi, In Quarantäne, [caf777c97b01340277d9a1fe03fec838], 
PUP.Optional.SmartBar, C:\Windows\Installer\MSID59.tmp, In Quarantäne, [655c55eb413b033366fecb6331cfa45c], 
Rogue.Multiple, C:\ProgramData\600440862\BIT2834.tmp, In Quarantäne, [3b8600403e3e989e2eebe8171de5a957], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

Alt 28.11.2014, 13:03   #8
Warlord711
/// TB-Ausbilder
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Danke für das Log.

Mach bitte zusätzlich:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
C:\ProgramData\600440862
emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

__________________
Lerne, zurück zu schlagen und unterstütze uns!
TB Akademie | Spende | Lob & Kritik

Alt 28.11.2014, 14:04   #9
Katzenauge88
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-11-2014 01
Ran by Christina at 2014-11-28 12:29:48 Run:1
Running from C:\Users\Christina\Downloads
Loaded Profiles: UpdatusUser & Christina &  (Available profiles: UpdatusUser & Christina)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Extension: UITBAutoInstaller - C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\{edd7fc99-d65c-4979-85c2-ddeed30c50c7} [2014-11-24]
S2 51cdb72; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro 3.11\OptProCrash.dll",ENT
*****************

Firefox newtab deleted successfully.
C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\{edd7fc99-d65c-4979-85c2-ddeed30c50c7} => Moved successfully.
51cdb72 => Service deleted successfully.

==== End of Fixlog ====

Alt 01.12.2014, 19:05   #10
Katzenauge88
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-12-2014
Ran by Christina at 2014-12-01 18:47:30 Run:2
Running from C:\Users\Christina\Downloads
Loaded Profiles: UpdatusUser & Christina &  (Available profiles: UpdatusUser & Christina)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\ProgramData\600440862
emptytemp:
         
*****************

"C:\ProgramData\600440862" => File/Directory not found.
EmptyTemp: => Removed 1.5 GB temporary data.


The system needed a reboot. 

==== End of Fixlog ====

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-12-2014
Ran by Christina (administrator) on VFL1900 on 01-12-2014 19:02:16
Running from C:\Users\Christina\Downloads
Loaded Profiles: UpdatusUser & Christina (Available profiles: UpdatusUser & Christina)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Akamai Technologies, Inc.) C:\Users\Christina\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Christina\AppData\Local\Akamai\netsession_win.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_239.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_239.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13538376 2013-05-13] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1307720 2013-04-24] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3016432 2013-03-07] (Synaptics Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Smart File Advisor] => C:\Program Files (x86)\Smart File Advisor\sfa.exe [283712 2013-11-26] (Filefacts.net)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-06-04] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132224 2013-02-28] ( (Atheros Communications))
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1940160 2014-11-18] (Valve Corporation)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [Akamai NetSession Interface] => C:\Users\Christina\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3600216 2014-10-11] (Electronic Arts)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\RunOnce: [Application Restart #1] => C:\Users\Christina\AppData\Local\Pokki\Engine\pokki.exe  --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-s (the data entry has 548 more characters).
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\RunOnce: [Application Restart #0] => C:\Users\Christina\AppData\Local\Pokki\Engine\HostAppService.exe  --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable (the data entry has 557 more characters).
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\MountPoints2: {1f037c66-3c1c-11e4-be8d-78843c345e4f} - "F:\Startme.exe" 
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\MountPoints2: {fe31343b-8dcd-11e3-be7b-78843c345e4f} - "D:\SETUP.EXE" 
HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\MountPoints2: {feb1c31a-26f2-11e4-be8b-78843c345e4f} - "E:\SISetup.exe" 
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [245872 2013-03-07] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [201576 2013-03-07] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2103582913-709214951-153368262-1001\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-2103582913-709214951-153368262-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
HKU\S-1-5-21-2103582913-709214951-153368262-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = 
SearchScopes: HKU\S-1-5-21-2103582913-709214951-153368262-1002 -> DefaultScope {7C4BC3F2-9BB5-4B11-AE8E-120F2AA7869E} URL = 
SearchScopes: HKU\S-1-5-21-2103582913-709214951-153368262-1002 -> {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-iobit
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default
FF SearchEngineOrder.3: Bing 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.20 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2103582913-709214951-153368262-1002: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: Avira Browser Safety - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\Extensions\abs@avira.com [2014-11-19]
FF Extension: Download videos and MP3s from YouTube - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\xo53irn6.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-11-24]
FF HKU\S-1-5-21-2103582913-709214951-153368262-1002\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-24]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-11-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-18] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [227968 2013-02-28] (Qualcomm Atheros Commnucations)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2615368 2013-02-27] (Acer Incorporated)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2443960 2014-10-30] (Microsoft Corporation)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [660040 2013-01-18] (Acer Incorporated)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-03-20] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-20] (Intel Corporation)
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [431656 2013-04-26] (Acer Incorporate)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
S3 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [4230016 2013-01-28] (Symantec Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16032 2014-09-22] (Microsoft Corporation)
S2 McAPExe; "C:\Program Files\McAfee\MSC\McAPExe.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-02-28] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0403000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-02-09] (Disc Soft Ltd)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-01-10] (Acer Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-01] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-03-20] (Intel Corporation)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)
S3 QRDCIO; C:\Windows\System32\drivers\QRDCIO.sys [9728 2009-10-20] (QUANTA)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [15704 2013-01-10] (Acer Incorporated)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [455240 2013-03-05] (RTS Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31984 2013-03-07] (Synaptics Incorporated)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-01 19:02 - 2014-12-01 19:02 - 00018538 _____ () C:\Users\Christina\Downloads\FRST.txt
2014-12-01 18:47 - 2014-12-01 18:47 - 02117120 _____ (Farbar) C:\Users\Christina\Downloads\FRST64.exe
2014-11-30 22:50 - 2014-11-30 22:50 - 00000222 _____ () C:\Users\Christina\Desktop\Far Cry 3.url
2014-11-30 18:44 - 2014-11-30 18:44 - 00000221 _____ () C:\Users\Christina\Desktop\Gothic II Gold Edition.url
2014-11-30 18:25 - 2014-11-30 18:25 - 00000221 _____ () C:\Users\Christina\Desktop\Broken Sword 1 - Shadow of the Templars Director's Cut.url
2014-11-28 12:30 - 2014-11-30 22:49 - 00014855 _____ () C:\Users\Christina\Desktop\Wohnungen.xlsx
2014-11-28 12:23 - 2014-11-28 12:23 - 00000000 ____D () C:\Users\Christina\Desktop\RevoUninstallerPortable
2014-11-27 15:23 - 2014-12-01 18:47 - 00000000 ____D () C:\Users\Christina\Downloads\FRST-OlderVersion
2014-11-27 15:21 - 2014-11-28 12:20 - 00008021 _____ () C:\Users\Christina\Desktop\mbam.txt
2014-11-27 13:55 - 2014-12-01 18:52 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-27 13:55 - 2014-11-27 13:55 - 00001122 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-11-27 13:55 - 2014-11-27 13:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-11-27 13:55 - 2014-11-27 13:55 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-27 13:55 - 2014-11-27 13:55 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-11-27 13:55 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-27 13:55 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-27 13:55 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-27 13:54 - 2014-11-27 13:54 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Christina\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-27 13:45 - 2014-11-27 13:45 - 00001250 _____ () C:\Users\Christina\Desktop\JRT.txt
2014-11-27 13:42 - 2014-11-27 13:42 - 00000000 ____D () C:\Windows\ERUNT
2014-11-27 13:41 - 2014-11-27 13:41 - 01707532 _____ (Thisisu) C:\Users\Christina\Downloads\JRT.exe
2014-11-27 12:29 - 2014-11-27 12:33 - 00000000 ____D () C:\AdwCleaner
2014-11-27 12:28 - 2014-11-27 12:28 - 02148864 _____ () C:\Users\Christina\Downloads\AdwCleaner_4.102.exe
2014-11-27 12:11 - 2014-11-28 12:22 - 00000000 ____D () C:\Users\Christina\Downloads\RevoUninstallerPortable
2014-11-27 12:10 - 2014-11-27 12:10 - 02785665 _____ (PortableApps.com) C:\Users\Christina\Downloads\RevoUninstallerPortable_1.95_Rev_2.paf.exe
2014-11-26 14:01 - 2014-11-26 14:02 - 00028376 _____ () C:\Users\Christina\Downloads\Addition.txt
2014-11-26 13:59 - 2014-12-01 19:02 - 00000000 ____D () C:\FRST
2014-11-26 13:33 - 2014-11-19 08:29 - 00582552 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe
2014-11-26 13:33 - 2014-11-19 08:29 - 00462760 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-11-26 10:54 - 2014-11-20 21:56 - 00713672 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-26 10:54 - 2014-11-20 21:56 - 00106440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-26 10:06 - 2014-11-26 10:06 - 00000131 _____ () C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\IObit Freeware.url
2014-11-26 10:06 - 2014-11-26 10:06 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-11-26 10:03 - 2014-11-26 10:03 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\TeamViewer
2014-11-26 10:03 - 2014-11-26 10:03 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-11-25 12:25 - 2014-11-25 12:25 - 02280510 _____ () C:\Users\Christina\Downloads\Maize.crop.calendar.fill.tar.gz
2014-11-24 16:25 - 2014-11-24 16:25 - 01169232 _____ () C:\Users\Christina\Downloads\wmp81n - CHIP-Installer.exe
2014-11-24 16:23 - 2014-11-24 16:23 - 01169232 _____ () C:\Users\Christina\Downloads\Windows Media Player - CHIP-Installer(1).exe
2014-11-24 16:22 - 2014-11-24 16:22 - 01169232 _____ () C:\Users\Christina\Downloads\Windows Media Player - CHIP-Installer.exe
2014-11-24 12:22 - 2014-11-24 12:22 - 00000000 ____D () C:\Program Files (x86)\WEB.DE MailCheck
2014-11-24 12:21 - 2014-11-24 12:22 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\DVDVideoSoft
2014-11-24 12:21 - 2014-11-24 12:21 - 00001536 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2014-11-24 12:21 - 2014-11-24 12:21 - 00001243 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-11-24 12:21 - 2014-11-24 12:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-11-24 12:21 - 2014-11-24 12:21 - 00000000 ____D () C:\Program Files (x86)\Free Codec Pack
2014-11-24 12:21 - 2014-11-24 12:21 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-11-24 12:16 - 2014-11-24 12:17 - 34667648 _____ (DVDVideoSoft Ltd. ) C:\Users\Christina\Downloads\FreeYouTubeToMP3Converter3.12.50.1111.exe
2014-11-19 23:27 - 2014-11-08 12:22 - 00238080 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-19 23:27 - 2014-11-08 12:21 - 00827904 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 23:27 - 2014-11-08 07:57 - 00187904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-19 23:27 - 2014-11-08 07:56 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-17 22:59 - 2014-11-17 22:59 - 00001141 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-11-14 00:31 - 2014-09-22 06:53 - 00035320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-11-14 00:31 - 2014-08-26 23:08 - 00270024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-11-14 00:30 - 2014-11-05 07:40 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-14 00:30 - 2014-11-05 07:38 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-14 00:30 - 2014-11-05 04:16 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-14 00:30 - 2014-10-11 08:45 - 10115072 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-11-14 00:30 - 2014-10-11 08:44 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-14 00:30 - 2014-10-11 08:44 - 00393216 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-11-14 00:30 - 2014-10-11 08:43 - 02307072 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-11-14 00:30 - 2014-10-11 06:58 - 08858624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-11-14 00:30 - 2014-10-11 06:57 - 02416640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-14 00:30 - 2014-10-11 06:57 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-11-14 00:30 - 2014-10-11 06:56 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-11-14 00:17 - 2014-10-18 09:44 - 00778240 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-14 00:17 - 2014-10-18 08:05 - 00567808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-14 00:17 - 2014-10-11 09:35 - 00171840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-14 00:17 - 2014-10-11 08:44 - 03248640 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-11-14 00:17 - 2014-10-11 08:44 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-11-14 00:17 - 2014-10-11 08:43 - 01281536 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-14 00:17 - 2014-10-11 06:57 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-11-14 00:17 - 2014-10-11 06:41 - 00713728 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-14 00:17 - 2014-10-11 06:41 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-14 00:17 - 2014-10-11 06:05 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-14 00:17 - 2014-10-11 06:04 - 00713728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-14 00:17 - 2014-10-03 02:21 - 00522728 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-14 00:17 - 2014-10-02 23:29 - 00783872 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-14 00:17 - 2014-10-02 23:29 - 00267264 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-14 00:17 - 2014-10-02 23:29 - 00169472 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2014-11-14 00:17 - 2014-10-02 00:05 - 04068864 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-14 00:17 - 2014-09-13 07:24 - 02233152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-11-14 00:17 - 2014-09-06 01:46 - 00389176 _____ () C:\Windows\system32\ApnDatabase.xml
2014-11-14 00:17 - 2014-09-03 03:48 - 00457728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2014-11-14 00:17 - 2014-09-03 03:48 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2014-11-14 00:17 - 2014-09-03 03:22 - 00188928 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2014-11-14 00:17 - 2014-09-03 03:21 - 00623104 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2014-11-14 00:17 - 2014-09-03 03:21 - 00212992 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2014-11-14 00:17 - 2014-08-29 05:17 - 02043392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-11-14 00:17 - 2014-08-29 05:17 - 00227328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-11-14 00:17 - 2014-08-29 05:04 - 02837504 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-11-14 00:17 - 2014-08-29 05:04 - 00309248 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-11-14 00:17 - 2014-08-28 07:04 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSCOMEX.dll
2014-11-14 00:17 - 2014-08-28 07:04 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSAPI.dll
2014-11-14 00:17 - 2014-08-28 06:59 - 00616448 _____ (Microsoft Corporation) C:\Windows\system32\FXSAPI.dll
2014-11-14 00:17 - 2014-08-28 06:59 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOMEX.dll
2014-11-14 00:17 - 2014-08-28 06:59 - 00432640 _____ (Microsoft Corporation) C:\Windows\system32\FXSTIFF.dll
2014-11-14 00:17 - 2014-08-28 06:59 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\FXST30.dll
2014-11-14 00:17 - 2014-07-24 14:12 - 00328512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-11-14 00:16 - 2014-10-23 13:47 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-14 00:16 - 2014-10-23 12:04 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-14 00:16 - 2014-09-25 00:29 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-14 00:16 - 2014-09-25 00:29 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptsslp.dll
2014-11-14 00:16 - 2014-09-25 00:01 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-14 00:16 - 2014-09-25 00:01 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\ncryptsslp.dll
2014-11-14 00:16 - 2014-08-22 00:56 - 01418752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-14 00:16 - 2014-08-22 00:27 - 01845760 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-14 00:15 - 2014-10-26 02:56 - 02237952 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-14 00:15 - 2014-10-26 02:56 - 01409536 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-14 00:15 - 2014-10-26 02:56 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-11-14 00:15 - 2014-10-26 02:56 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-14 00:15 - 2014-10-26 02:55 - 19284480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-14 00:15 - 2014-10-26 02:55 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-14 00:15 - 2014-10-26 02:55 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-14 00:15 - 2014-10-26 02:55 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 15399424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-14 00:15 - 2014-10-26 02:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-11-14 00:15 - 2014-10-26 02:53 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-14 00:15 - 2014-10-26 01:36 - 01762816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 14368768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-14 00:15 - 2014-10-26 01:35 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 13758464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-14 00:15 - 2014-10-26 01:34 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-14 00:15 - 2014-10-26 01:34 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-11-14 00:14 - 2014-10-26 02:56 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-11-14 00:14 - 2014-10-26 02:54 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-14 00:14 - 2014-10-26 02:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-14 00:14 - 2014-10-26 02:54 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-14 00:14 - 2014-10-26 02:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-14 00:14 - 2014-10-26 01:35 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-11-14 00:14 - 2014-10-26 01:34 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-14 00:14 - 2014-10-26 01:34 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-14 00:14 - 2014-10-26 01:34 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-14 00:14 - 2014-10-26 01:34 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-14 00:14 - 2014-10-26 01:19 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-14 00:14 - 2014-10-26 01:13 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-11-14 00:14 - 2014-10-25 22:48 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-11-10 22:54 - 2014-11-24 12:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-07 20:36 - 2014-11-07 20:36 - 01054912 _____ (Adobe) C:\Users\Christina\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
2014-11-07 20:30 - 2014-11-08 22:48 - 00000000 ____D () C:\Windows\system32\AutoUpdateLicense
2014-11-06 21:53 - 2014-11-06 21:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-11-05 11:10 - 2014-11-05 11:10 - 00000000 ____D () C:\Users\Christina\AppData\Local\ArcGISRuntime
2014-11-04 10:11 - 2014-11-04 10:20 - 00000000 ____D () C:\Users\Christina\Desktop\Singen
2014-11-04 08:52 - 2014-11-04 08:53 - 00013904 _____ () C:\Users\Christina\Downloads\mapserv.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-01 19:02 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru
2014-12-01 18:57 - 2013-11-13 19:52 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2014-12-01 18:57 - 2013-11-13 19:52 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2014-12-01 18:57 - 2012-07-26 08:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-01 18:56 - 2014-01-04 17:51 - 00003594 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2103582913-709214951-153368262-1002
2014-12-01 18:51 - 2014-01-21 12:09 - 01176064 ___SH () C:\Users\Christina\Desktop\Thumbs.db
2014-12-01 18:50 - 2014-01-04 17:41 - 00000000 ____D () C:\Users\Christina
2014-12-01 18:50 - 2013-08-02 15:50 - 00181922 _____ () C:\Windows\PFRO.log
2014-12-01 18:50 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-01 18:50 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-12-01 18:30 - 2014-07-21 12:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-30 23:30 - 2014-01-04 18:00 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-11-30 19:43 - 2014-01-08 12:51 - 00000000 ____D () C:\Users\Christina\AppData\Local\Deployment
2014-11-30 19:27 - 2014-07-08 09:46 - 00000222 _____ () C:\Users\Christina\Desktop\DayZ.url
2014-11-30 19:26 - 2014-01-04 18:20 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-11-30 10:02 - 2014-01-04 18:28 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Skype
2014-11-29 10:04 - 2013-11-13 11:10 - 01177916 _____ () C:\Windows\WindowsUpdate.log
2014-11-28 14:03 - 2014-10-27 14:45 - 00000000 ____D () C:\Users\Christina\Desktop\GIS
2014-11-27 14:32 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\NDF
2014-11-27 12:19 - 2014-02-23 15:36 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-11-26 18:12 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\rescache
2014-11-26 17:03 - 2012-07-26 08:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-11-26 11:38 - 2014-03-04 14:50 - 00141968 _____ () C:\Users\Christina\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-26 10:57 - 2014-09-26 17:55 - 00002114 _____ () C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk
2014-11-26 10:56 - 2014-10-25 14:15 - 00513768 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-25 22:16 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-11-25 21:33 - 2014-07-21 12:53 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-25 18:22 - 2014-10-27 14:52 - 00000000 ____D () C:\arcgis
2014-11-25 14:27 - 2014-01-04 17:42 - 00000000 ____D () C:\Users\Christina\AppData\Local\Packages
2014-11-23 21:31 - 2012-07-26 08:21 - 01611993 _____ () C:\Windows\setupact.log
2014-11-23 11:35 - 2014-01-05 20:28 - 00002285 _____ () C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2014-11-23 00:44 - 2014-01-04 17:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-21 20:16 - 2014-10-19 13:20 - 00000000 ____D () C:\Users\Christina\Desktop\Fortbildung Hydrogeologie
2014-11-21 08:40 - 2014-01-08 12:42 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-11-17 22:59 - 2014-10-16 10:50 - 00000000 ____D () C:\ProgramData\Package Cache
2014-11-17 22:59 - 2014-02-23 15:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-11-17 22:51 - 2014-07-21 12:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ___RD () C:\Windows\ToastData
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Windows Defender
2014-11-17 22:51 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-11-17 22:50 - 2014-01-05 23:24 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-17 22:47 - 2014-01-05 23:24 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-14 12:22 - 2014-01-08 10:12 - 00000000 ____D () C:\Users\Christina\AppData\Local\Akamai
2014-11-07 22:50 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-11-07 20:30 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\WinStore
2014-11-06 21:53 - 2014-03-07 23:05 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-11-06 21:53 - 2014-03-07 23:05 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-11-06 21:53 - 2014-01-04 18:27 - 00000000 ____D () C:\ProgramData\Skype
2014-11-04 10:17 - 2014-10-27 14:45 - 00000000 ____D () C:\Users\Christina\Desktop\Sonstiges

Files to move or delete:
====================
C:\Users\Christina\SETUP.EXE


Some content of TEMP:
====================
C:\Users\Christina\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-28 13:57

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Code:
ATTFilter
 Results of screen317's Security Check version 0.99.91  
   x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop      
Windows Defender   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 2.0.3.1025  
 Java 7 Update 71  
 Adobe Flash Player 	15.0.0.239  
 Adobe Reader XI  
 Mozilla Firefox (33.1) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

Alt 01.12.2014, 19:07   #11
Warlord711
/// TB-Ausbilder
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Sieht doch schon gut aus, fehlt nur noch das ESET Log ;-)

Ich weiss, das dauert länger...
__________________
Lerne, zurück zu schlagen und unterstütze uns!
TB Akademie | Spende | Lob & Kritik

Alt 02.12.2014, 17:20   #12
Katzenauge88
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Hey, also ich habe jetzt zweimal den Eset Scan versucht und jedes mal (einmal nach der hälfte ca. und heute bei 99%) ist mein PC abgestürzt. Ich konnte keine Programme mehr öffnen oder schließen, der Taskmanager öffnete sich nicht und selbst beim Zuklappen blieb der Bildschirm an...merkwürdigerweis war nur die Maus nicht "eingefroren".
Ich musste dann reseten und neustarten...was soll ich jetzt tun? nochmal den Scan machen?
Schonmal danke für deine Hilfe!!!

Alt 03.12.2014, 12:18   #13
Warlord711
/// TB-Ausbilder
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Schau mal ob er ein Log geschrieben hat:
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
__________________
Lerne, zurück zu schlagen und unterstütze uns!
TB Akademie | Spende | Lob & Kritik

Alt 03.12.2014, 17:07   #14
Katzenauge88
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet

Alt 03.12.2014, 21:07   #15
Warlord711
/// TB-Ausbilder
 
Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Standard

Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


Hmm musst wohl nochmal scannen.

Sorry
__________________
Lerne, zurück zu schlagen und unterstütze uns!
TB Akademie | Spende | Lob & Kritik

Antwort
Seite 1 von 2 1 2

Themen zu Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC
ask toolbar entfernen, avira savings advisor entfernen, betrugsopfer, fehlercode 22, microsoft mitarbeiter, msil/toolbar.linkury.d, msil/toolbar.linkury.e, msil/toolbar.linkury.f, msil/toolbar.linkury.g, msil/toolbar.linkury.i, optimizer pro v3.2 entfernen, pup.optional.conduit.a, pup.optional.helperbar.a, pup.optional.opencandy, pup.optional.smartbar, pup.optional.snapdo.a, pup.optional.snapdo.t, pup.optional.softonic.a, rogue.multiple, search protect entfernen, this device is disabled. (code 22), win32/toolbar.conduit.r, win32/toolbar.linkury.d, win32/toolbar.linkury.e, win32/toolbar.linkury.g, yahoo community smartbar entfernen


« Ihr Computer ist bereit zur Sicherung Virus eingefangen. | Win 8, Weisser Bildschirm, betrieb geht nur noch über Externen Monitor. »


Ähnliche Themen: Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC


  1. Anruf von angeblichen Microsoft Mitarbeiter - nun ist Computer gesperrt 2015
    Log-Analyse und Auswertung - 15.10.2015 (1)
  2. Zugriff von außen auf meinen Rechner
    Log-Analyse und Auswertung - 12.08.2015 (25)
  3. Remote Zugriff auf meinen Computer?
    Plagegeister aller Art und deren Bekämpfung - 26.05.2015 (15)
  4. Hat jemand Zugriff auf meinen Laptop?
    Log-Analyse und Auswertung - 22.05.2015 (14)
  5. Windows 7: Anruf von angeblichen Microsoft Mitarbeiter wegen Sicherheitsproblem
    Plagegeister aller Art und deren Bekämpfung - 08.04.2015 (13)
  6. firefoxvirus + zugriff auf meinen facebookacc
    Plagegeister aller Art und deren Bekämpfung - 11.11.2014 (15)
  7. Anruf von angeblichen Microsoft Mitarbeiter - nun ist Computer gesperrt
    Log-Analyse und Auswertung - 14.07.2014 (7)
  8. Microsoft Mitarbeiter aus Australien steuert Computer
    Plagegeister aller Art und deren Bekämpfung - 03.02.2014 (1)
  9. LKA NRW warnt vor Betrugsversuchen angeblicher Microsoft-Mitarbeiter
    Nachrichten - 13.01.2014 (0)
  10. Fremder Zugriff auf meinen Kalender
    Alles rund um Windows - 16.09.2013 (0)
  11. Gvu Virus - keinen Zugriff mehr auf meinen Laptop
    Log-Analyse und Auswertung - 15.07.2013 (5)
  12. Seltsamer Anruf von einem angeblichen Microsoft Mitarbeiter
    Alles rund um Windows - 09.12.2012 (3)
  13. Hilfe ich soll 50€ bezahlen wg. angeblicher Pornos damit ich meinen Rechner weiter nutzen kann
    Log-Analyse und Auswertung - 20.03.2012 (1)
  14. Fremder Zugriff auf meinen YAHOO MailAccount
    Plagegeister aller Art und deren Bekämpfung - 06.12.2011 (1)
  15. Zugriff auf meinen Rechner?!
    Log-Analyse und Auswertung - 26.03.2010 (8)
  16. Microsoft testet Sicherheitsbewusstsein der eigenen Mitarbeiter
    Nachrichten - 14.01.2010 (0)
  17. zugriff auf meinen lap top?
    Überwachung, Datenschutz und Spam - 28.08.2009 (7)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC - Hallo Leute, ich war heut morgen so dumm und bin Opfer einer neuen Internetbetrugsmasche geworden. Mehrere Fakoren begünstigten dies: 1. Der Hacker (englischsprachiger Mann mit indischem Akzent) klingelte mich aus - Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC...
Archiv
Du betrachtest: Angeblicher Microsoft Mitarbeiter erhält Zugriff auf meinen PC auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55