Hallo und vorab schon Danke für Eure Hilfe.

Mein Notebook wird zunehmend langsamer. Sowohl beim Surfen (trotz 50MB/s Verbindung) als auch beim wechelseitigen Öffnen der Fenster gibt es ungewöhnliche Verzögerungen.

Anti-Malware findet nichts weiter.

Ich habe hier die Logfiles:

defogger_disabled:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:57 on 26/01/2015 (Ronald)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-




FRST.txt:
FRST Logfile:
[CODE]Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by Ronald (administrator) on NOTEBOOKRONNIE on 26-01-2015 10:58:53
Running from C:\Users\Ronald\Downloads
Loaded Profiles: Ronald (Available profiles: Ronald)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMLockHandler.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAEvent.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAMsg.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIKEE.EXE
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerWinMonitor.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\RMSvc.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)


und Addition.txt:FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2015 01
Ran by Ronald at 2015-01-26 11:00:41
Running from C:\Users\Ronald\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

abFiles (HKLM-x32\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.00.3002 - Acer Incorporated)
Acer Care Center (HKLM\...\{A424844F-CDB3-45E2-BB77-1DDE4A091E76}) (Version: 1.00.3008 - Acer Incorporated)
Acer Explorer Agent (HKLM\...\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3000 - Acer Incorporated)
Acer Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.8107 - Acer Incorporated)
Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.01.2014 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.8105 - Acer Incorporated)
Acer Quick Access (HKLM\...\{C1FA525F-D701-4B31-9D32-504FC0CF0B98}) (Version: 1.01.3016.0 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.8108 - Acer Incorporated)
Acer User Experience Improvement Program App Monitor Plugin (HKLM\...\{978724F6-1863-4DD5-9E66-FB77F5AB5613}) (Version: 1.02.3005 - Acer Incorporated)
Acer User Experience Improvement Program Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 1.02.3005 - Acer Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
Biet-O-Matic v2.14.12 (HKLM-x32\...\Biet-O-Matic v2.14.12) (Version: 2.14.12 - BOM Development Team)
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 6.30.223.234 - Broadcom Corporation)
BUFFALO NAS Navigator2 (HKLM-x32\...\UN060501) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Content Manager 2 (HKLM-x32\...\Content Manager 2) (Version: 3.1.1.10436 - NNG Llc.)
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.4917 - CyberLink Corp.)
CyberLink Power Media Player 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3.4218 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
dradio-Recorder Version 3.02.6 (HKLM-x32\...\dradio-Recorder_is1) (Version: - )
Dropbox (HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Dropbox) (Version: 2.10.41 - Dropbox, Inc.)
Druckerdeinstallation für EPSON WF-3620 Series (HKLM\...\EPSON WF-3620 Series) (Version: - SEIKO EPSON Corporation)
eBay Worldwide (HKLM-x32\...\{91589413-6675-4C27-8AFC-EFB9103B90A5}) (Version: 2.4.0105 - OEM)
ELAN HIDI2C Filter Driver X64 13.6.1.1_WHQL (HKLM\...\Elantech) (Version: 13.6.1.1 - ELAN Microelectronic Corp.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.15910 - Landesfinanzdirektion Thüringen)
Epson Event Manager (HKLM-x32\...\{0F13C24A-FFE2-4CD0-8E0B-DC804E0A0E0B}) (Version: 3.10.0035 - Seiko Epson Corporation)
Epson FAX Utility (HKLM-x32\...\{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}) (Version: 1.51.00 - SEIKO EPSON CORPORATION)
Epson PC-FAX Driver (HKLM-x32\...\EPSON PC-FAX Driver 2) (Version: - )
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EPSON Scan OCR Component (HKLM-x32\...\{563B99D8-8895-4E3E-AE8D-15BE8C05F1C1}) (Version: 2.00.0000 - SEIKO EPSON Corp.)
EPSON Scan PDF Extensions (HKLM-x32\...\{F9956472-6E16-4F83-BF9A-F887EF4A45B7}) (Version: 1.03.0001 - SEIKO EPSON Corp.)
EPSON-Handbücher (HKLM-x32\...\{84CECC1B-21EF-41B1-9A91-3E724E5D99D3}) (Version: 1.32.0.0 - SEIKO EPSON CORPORATION)
EpsonNet Config V4 (HKLM-x32\...\{08013FB5-DF8B-4D29-9B5E-B3DE88EBA6CA}) (Version: 4.4.3 - SEIKO EPSON CORPORATION)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Host App Service (HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Pokki) (Version: 0.269.3.181 - Pokki)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM-x32\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\OneDriveSetup.exe) (Version: 17.3.1229.0918 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{d491dd9d-2eda-4d75-b504-1a201436e7fd}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{90ffcee5-8608-4e94-8c18-a4feb4f83fb8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
mp3schneiden (HKLM-x32\...\mp3schneiden_is1) (Version: 2.0 - Abelssoft)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
Naviextras Toolbox Prerequesities (HKLM-x32\...\{537575D6-3B96-474C-BD8F-DFF667363DBD}) (Version: 1.0.0 - NNG Llc.)
Pokki Start Menu (HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Pokki_Start_Menu) (Version: 0.269.3.181 - )
Presto! PageManager 9.03 SE (HKLM-x32\...\{04AF7536-446D-4F5A-8920-B4E885E4581B}) (Version: 9.03.06 - Newsoft Technology Corporation)
Protect Disc License Helper 1.0.118 (HKLM-x32\...\Protect Disc License Helper) (Version: 1.0.118 - Protect Disc)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.12 - ProtectDisc Software GmbH)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.21245 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.24.1218.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7209 - Realtek Semiconductor Corp.)
Spotify (HKLM-x32\...\Spotify) (Version: 0.9.6.81.gd359a796 - Spotify AB)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WIDCOMM Bluetooth Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.9350 - Broadcom Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
X Codec Pack (HKLM\...\X Codec Pack) (Version: 2.7.0 - X Codec Pack team)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Ronald\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Ronald\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ronald\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ronald\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ronald\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ronald\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ronald\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ronald\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ronald\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ronald\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points =========================

06-01-2015 18:44:14 Geplanter Prüfpunkt
13-01-2015 11:52:11 DVDVideoSoftRestorePoint
16-01-2015 14:25:51 Visual Pinball wird installiert
19-01-2015 14:31:17 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
21-01-2015 14:57:44 Installed Software Updater
23-01-2015 23:41:08 Removed abFiles
26-01-2015 09:30:08 Removed Software Updater

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1CA34DE4-433C-40B3-BE47-FD05AA366C7D} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-01-16] (Microsoft Corporation)
Task: {2682B411-C213-44B3-9CD6-A1C6BB87BCA4} - System32\Tasks\EPSON WF-3620 Series Invitation {EC877D19-896B-4AB9-A4B7-7E85763CA19A} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKEE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {2923779E-6EEB-48BE-A74D-8C074541E151} - System32\Tasks\ACCAgent => C:\Program Files (x86)\Acer\Care Center\LiveUpdateAgent.exe [2014-08-29] ()
Task: {2DBF2B80-71B9-4FC5-A7A4-DBACE5950C2F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: {3020F3B3-EA22-4CB0-BD3B-FCEBB6E6AC70} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2014-06-26] (Acer Incorporate)
Task: {4621F24C-2B09-4415-A9B5-59E80B23B1ED} - System32\Tasks\ACC => C:\Program Files (x86)\Acer\Care Center\LiveUpdateChecker.exe [2014-08-29] ()
Task: {5C2A916B-C95C-4692-AB73-51F3282ADE68} - System32\Tasks\Quick Access Quick Launcher => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2014-06-26] (Acer Incorporate)
Task: {68D2ACB0-F6C9-4CCC-B80F-3DF0F4A1F704} - System32\Tasks\EPSON WF-3620 Series Update {EC877D19-896B-4AB9-A4B7-7E85763CA19A} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKEE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {6D13A0A5-6665-4509-9690-F5FA086FF125} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {7B5B614D-D9EC-480E-BAFD-BBEBFE782DBC} - System32\Tasks\Launch Manager => C:\Program Files\Acer\Acer Launch Manager\LMLauncher.exe [2014-06-10] (Acer Incorporate)
Task: {7CC3A020-2B4B-420B-B12D-B45BF4A1101B} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2014-06-17] (Acer Incorporated)
Task: {892FBB33-C66E-4AFB-9011-6B81BD55D7CB} - System32\Tasks\EPSON WF-3620 Series Invitation {13246269-553D-40F2-A8D7-B16731EBE536} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKEE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {998995D5-F62B-437F-9D84-46DB952C5FB0} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTrayLauncher.exe [2014-06-12] (Acer Incorporated)
Task: {9C01B594-5238-478A-92DC-C1A8A8306139} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2227299661-2928916897-3466982639-1001 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {A6283606-8423-4165-902D-7A77432B19FD} - \ASP No Task File <==== ATTENTION
Task: {AA9F1F0F-147D-4013-A93A-B1C5D81C0680} - System32\Tasks\Software Update Application => C:\ProgramData\OEM\UpgradeTool\ListCheck.exe [2014-06-08] (Acer Incorporated)
Task: {ACA2629C-F837-436F-8F6A-BFE7A6D27739} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-12-07] (AVAST Software)
Task: {D1D6FF14-B7A5-4C42-8D39-2A099AB08840} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {F2EAD7E2-6C65-4A3B-8640-6A1796AB9BDB} - System32\Tasks\EPSON WF-3620 Series Update {13246269-553D-40F2-A8D7-B16731EBE536} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKEE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {F69239AC-BF10-463C-8CAE-7FD508923AE7} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [2014-03-13] (TODO: <Company name>)
Task: {F755230F-C227-4F17-8539-8168B8570140} - System32\Tasks\AcerCloud => C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe [2014-08-21] (Acer)
Task: {F9DA7681-09E4-4D5B-999D-236C6D65225C} - System32\Tasks\{80257D2B-ADC0-4421-B2B1-863F85ACA366} => pcalua.exe -a "C:\Program Files (x86)\SamProject\SamPro.exe" -d "C:\Program Files (x86)\SamProject"
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\EPSON WF-3620 Series Invitation {13246269-553D-40F2-A8D7-B16731EBE536}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKEE.EXE
Task: C:\Windows\Tasks\EPSON WF-3620 Series Invitation {EC877D19-896B-4AB9-A4B7-7E85763CA19A}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKEE.EXE
Task: C:\Windows\Tasks\EPSON WF-3620 Series Update {13246269-553D-40F2-A8D7-B16731EBE536}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKEE.EXE
Task: C:\Windows\Tasks\EPSON WF-3620 Series Update {EC877D19-896B-4AB9-A4B7-7E85763CA19A}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKEE.EXE

==================== Loaded Modules (whitelisted) =============

2014-02-18 19:02 - 2014-02-18 19:02 - 00049368 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btwleapi.dll
2014-12-07 20:28 - 2014-12-07 20:28 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2014-12-07 20:28 - 2014-12-07 20:28 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2015-01-26 09:32 - 2015-01-26 09:32 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15012501\algo.dll
2014-12-07 20:28 - 2014-12-07 20:28 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2014-10-13 15:33 - 2014-11-26 17:40 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-12-07 20:28 - 2014-12-07 20:28 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Ronald\OneDrive:ms-properties
AlternateDataStreams: C:\Users\Ronald\Documents\d+d+d+ddidoiioideidsidsiisisopaaaaaaaaopspoopaoippcxgtogoijgogpfüsd+sd.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iaioi2ce.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "Bluetooth.lnk"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "FUFAXRCV"
HKLM\...\StartupApproved\Run32: => "FUFAXSTM"
HKLM\...\StartupApproved\Run32: => "PMSpeed"
HKLM\...\StartupApproved\Run32: => "WrtMon.exe"
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\StartupApproved\StartupFolder: => "BUFFALO NAS Navigator2.lnk"
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\StartupApproved\StartupFolder: => "NAS Scheduler.lnk"
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\StartupApproved\Run: => "Pokki"
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\StartupApproved\Run: => "dradio-RecorderTimer"
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\StartupApproved\Run: => "EPLTarget\P0000000000000000"
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\StartupApproved\Run: => "Adobe Speed Launcher"
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\StartupApproved\Run: => "Scan Buttons"

========================= Accounts: ==========================

Administrator (S-1-5-21-2227299661-2928916897-3466982639-500 - Administrator - Disabled)
Gast (S-1-5-21-2227299661-2928916897-3466982639-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2227299661-2928916897-3466982639-1003 - Limited - Enabled)
Ronald (S-1-5-21-2227299661-2928916897-3466982639-1001 - Administrator - Enabled) => C:\Users\Ronald

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/26/2015 10:38:05 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (01/26/2015 10:38:04 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (01/26/2015 10:34:16 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (01/26/2015 10:34:14 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (01/26/2015 10:00:10 AM) (Source: ESENT) (EventID: 455) (User: )
Description: wlmail (5832) WindowsLiveMail0: Fehler -1032 (0xfffffbf8) beim Öffnen von Protokolldatei C:\Users\Ronald\AppData\Local\Microsoft\Windows Live Mail\edb.log.

Error: (01/26/2015 10:00:10 AM) (Source: ESENT) (EventID: 489) (User: )
Description: wlmail (5832) WindowsLiveMail0: Versuch, Datei "C:\Users\Ronald\AppData\Local\Microsoft\Windows Live Mail\edb.log" für den Lesezugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error: (01/26/2015 09:59:30 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0xafc
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5

Error: (01/25/2015 05:20:56 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: NOTEBOOKRONNIE)
Description: Bei der Aktivierung der App „Microsoft.SkypeApp_kzf8qxf38zg5c!App“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (01/25/2015 05:20:54 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: NOTEBOOKRONNIE)
Description: Die App „Microsoft.SkypeApp_3.1.0.1007_x86__kzf8qxf38zg5c+App“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (01/25/2015 05:20:15 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: NOTEBOOKRONNIE)
Description: Bei der Aktivierung der App „Microsoft.SkypeApp_kzf8qxf38zg5c!App“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.


System errors:
=============
Error: (01/26/2015 10:49:30 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: 

Error: (01/26/2015 10:49:30 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: 

Error: (01/24/2015 00:23:55 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: 

Error: (01/24/2015 00:23:55 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: 

Error: (01/16/2015 02:41:04 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: 

Error: (01/16/2015 02:41:04 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: 

Error: (01/16/2015 02:37:54 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: Windows-Tool zum Entfernen bösartiger Software für Windows 8, 8.1 und Windows Server 2012, 2012 R2 x64 Edition - Januar 2015 (KB890830)

Error: (01/13/2015 04:46:11 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: 

Error: (01/13/2015 04:46:11 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: 

Error: (01/13/2015 04:43:42 PM) (Source: DCOM) (EventID: 10010) (User: NOTEBOOKRONNIE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2015-01-23 23:07:35.780
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-01-23 21:09:45.299
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU N3530 @ 2.16GHz
Percentage of memory in use: 34%
Total physical RAM: 3979.2 MB
Available physical RAM: 2608.34 MB
Total Pagefile: 4747.2 MB
Available Pagefile: 3299.08 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:915.17 GB) (Free:757.4 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 8E22B8BD)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

--- --- ---

--- --- ---


Das GMER-Programm lief bei mir nicht.



Erbitte Hilfe und nächste Schritte. Danke.

hi,

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hier der mbam.txt:

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software

Suchlauf Datum: 26.01.2015
Suchlauf-Zeit: 11:25:16
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.01.26.04
Rootkit Datenbank: v2015.01.14.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Ronald

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 380880
Verstrichene Zeit: 26 Min, 15 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)



Hier der log vom ADWCleaner (der mich aber nicht um Neustart bat bzw. diesen ausführte):


# AdwCleaner v4.109 - Bericht erstellt am 26/01/2015 um 12:03:32
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-01-25.1 [Live]
# Betriebssystem : Windows 8.1 (64 bits)
# Benutzername : Ronald - NOTEBOOKRONNIE
# Gestartet von : C:\Users\Ronald\Downloads\AdwCleaner_4.109.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\4jw3roga.default\user.js
Datei Gefunden : C:\Windows\System32\roboot64.exe
Ordner Gefunden : C:\Users\Ronald\AppData\Roaming\RHEng
Ordner Gefunden : C:\Users\Ronald\AppData\Roaming\Systweak

***** [ Tasks ] *****

Task Gefunden : ASP

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\Classes\pokki
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : HKCU\Software\Pokki
Schlüssel Gefunden : HKCU\Software\systweak
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\Pokki
Schlüssel Gefunden : [x64] HKCU\Software\systweak
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gefunden : HKLM\SOFTWARE\systweak
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Wert Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Pokki]

***** [ Browser ] *****


und hier der JRT.txt:JRT Logfile:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 8.1 x64
Ran by Ronald on 26.01.2015 at 12:09:32,36
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Ronald\AppData\Roaming\systweak"



~~~ FireFox

Successfully deleted: [File] C:\Users\Ronald\AppData\Roaming\mozilla\firefox\profiles\4jw3roga.default\user.js
Emptied folder: C:\Users\Ronald\AppData\Roaming\mozilla\firefox\profiles\4jw3roga.default\minidumps [8 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.01.2015 at 12:17:33,28
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

--- --- ---

Danke!

Oh, sry FRST kommt sofort.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by Ronald (administrator) on NOTEBOOKRONNIE on 26-01-2015 12:21:20
Running from C:\Users\Ronald\Downloads
Loaded Profiles: Ronald (Available profiles: Ronald)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMLockHandler.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAEvent.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAMsg.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIKEE.EXE
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerWinMonitor.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\RMSvc.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe
() C:\Users\Ronald\Downloads\AdwCleaner_4.109.exe
(Thisisu) C:\Users\Ronald\Downloads\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672304 2014-03-21] (Realtek Semiconductor)
HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe [26448 2008-05-24] (NewSoft Technology Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-09] (AVAST Software)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [642664 2014-05-26] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [863848 2014-05-26] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1065024 2014-05-02] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [PMSpeed] => C:\Program Files (x86)\NewSoft\Presto! PageManager 9.03\PMSpeed.EXE [116632 2010-07-29] (NewSoft Technology Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Run: [Pokki] => "%LOCALAPPDATA%\Pokki\Engine\HostAppServiceUpdater.exe" /LOGON
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Run: [dradio-RecorderTimer] => C:\Program Files (x86)\dradio-Recorder\phonostarTimer.exe [42496 2012-10-13] ()
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIKEE.EXE [298560 2013-09-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIKEE.EXE [298560 2013-09-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Run: [Scan Buttons] => C:\Program Files (x86)\NewSoft\Presto! PageManager 9.03\Pmsb.exe [214360 2011-01-21] (NewSoft Technology Corporation)
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Ronald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BUFFALO NAS Navigator2.lnk
ShortcutTarget: BUFFALO NAS Navigator2.lnk -> C:\Program Files (x86)\BUFFALO\NASNAVI\NasNavi.exe (BUFFALO INC.)
Startup: C:\Users\Ronald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NAS Scheduler.lnk
ShortcutTarget: NAS Scheduler.lnk -> C:\Program Files (x86)\BUFFALO\NASNAVI\nassche.exe (BUFFALO INC.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [ACloudSyncedRF] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated)
ShellIconOverlayIdentifiers: [ACloudSyncedSF] -> {5D5F18B7-D59B-4B18-A3E9-0A4BDCCCB699} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated)
ShellIconOverlayIdentifiers: [ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated)
ShellIconOverlayIdentifiers: [ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com/?pc=ACJB
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001 -> DefaultScope {79C55BEB-84AF-4D47-A092-51AC4DD4F71A} URL =
SearchScopes: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001 -> {79C55BEB-84AF-4D47-A092-51AC4DD4F71A} URL =
SearchScopes: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\4jw3roga.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2227299661-2928916897-3466982639-1001: @phonostar.de/phonostar -> C:\Program Files (x86)\dradio-Recorder\npphonostarDetectNP.dll No File
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-10-13]

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-07]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-07] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-07] (Avast Software)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2251992 2013-11-14] (Broadcom Corporation.)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2573032 2014-06-12] (Acer Incorporated)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [315352 2014-05-30] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [466664 2014-06-10] (Acer Incorporate)
R2 NasPmService; C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe [251184 2009-05-15] (BUFFALO INC.)
R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [458984 2014-06-26] (Acer Incorporate)
R3 RMSvc; C:\Program Files\Acer\Acer Quick Access\RMSvc.exe [449768 2014-06-26] (Acer Incorporate)
R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [234240 2014-07-15] (acer)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-07] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-07] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-07] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-07] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-07] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-07] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-07] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-07] ()
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-11-14] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7549616 2014-02-25] (Broadcom Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R3 ETDI2C; C:\Windows\system32\DRIVERS\ETDI2C.sys [173384 2014-04-09] (ELAN Microelectronic Corp.)
S3 GPIO; C:\Windows\System32\drivers\iaiogpioe.sys [31232 2013-11-11] (Intel Corporation)
R3 iaioi2c; C:\Windows\System32\drivers\iaioi2ce.sys [67584 2013-11-11] (Intel Corporation)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [461528 2013-12-20] (Realsil Semiconductor Corporation)
U5 TMUSB; C:\Windows\System32\DRIVERS\TMUSB64.SYS [63096 2013-10-29] (Seiko Epson Corporation)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-07] (Avast Software)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
U3 kwtoapoc; \??\C:\Users\Ronald\AppData\Local\Temp\kwtoapoc.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-26 12:17 - 2015-01-26 12:17 - 00000936 _____ () C:\Users\Ronald\Desktop\JRT.txt
2015-01-26 12:09 - 2015-01-26 12:09 - 01707939 _____ (Thisisu) C:\Users\Ronald\Downloads\JRT.exe
2015-01-26 12:09 - 2015-01-26 12:09 - 00000000 ____D () C:\Windows\ERUNT
2015-01-26 12:03 - 2015-01-26 12:07 - 00000000 ____D () C:\AdwCleaner
2015-01-26 12:02 - 2015-01-26 12:02 - 02194432 _____ () C:\Users\Ronald\Downloads\AdwCleaner_4.109.exe
2015-01-26 12:00 - 2015-01-26 12:00 - 00001191 _____ () C:\Users\Ronald\Desktop\mbam.txt
2015-01-26 11:05 - 2015-01-26 11:05 - 00380416 _____ () C:\Users\Ronald\Downloads\7xmlgwi0.exe
2015-01-26 11:00 - 2015-01-26 11:01 - 00032517 _____ () C:\Users\Ronald\Downloads\Addition.txt
2015-01-26 10:58 - 2015-01-26 12:21 - 00016299 _____ () C:\Users\Ronald\Downloads\FRST.txt
2015-01-26 10:58 - 2015-01-26 12:21 - 00000000 ____D () C:\FRST
2015-01-26 10:58 - 2015-01-26 10:58 - 02129920 _____ (Farbar) C:\Users\Ronald\Downloads\FRST64.exe
2015-01-26 10:57 - 2015-01-26 10:57 - 00000474 _____ () C:\Users\Ronald\Downloads\defogger_disable.log
2015-01-26 10:57 - 2015-01-26 10:57 - 00000000 _____ () C:\Users\Ronald\defogger_reenable
2015-01-26 10:56 - 2015-01-26 10:56 - 00050477 _____ () C:\Users\Ronald\Downloads\Defogger.exe
2015-01-26 10:51 - 2015-01-26 10:53 - 00000197 _____ () C:\Windows\system32\2015-01-26-09-51-35.011-AvastVBoxSVC.exe-2376.log
2015-01-26 09:54 - 2015-01-26 09:54 - 00544303 _____ () C:\Users\Ronald\Downloads\noscript_security_suite-2.6.9.11-sm_fn_fx.xpi
2015-01-24 10:17 - 2015-01-24 10:17 - 00000197 _____ () C:\Windows\system32\2015-01-24-09-17-19.081-AvastVBoxSVC.exe-3004.log
2015-01-23 23:49 - 2015-01-23 23:49 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\WildTangent
2015-01-20 10:54 - 2015-01-20 10:59 - 00000000 ____D () C:\Users\Ronald\AppData\Local\.elfohilfe
2015-01-19 14:30 - 2015-01-19 14:38 - 00000000 ____D () C:\Users\Ronald\AppData\Local\elfopatch
2015-01-17 09:34 - 2015-01-17 09:34 - 04188536 _____ (Piriform Ltd) C:\Users\Ronald\Downloads\ccsetup501_slim.exe
2015-01-17 09:34 - 2015-01-17 09:34 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-01-17 09:34 - 2015-01-17 09:34 - 00000838 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-01-17 09:34 - 2015-01-17 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-01-17 09:34 - 2015-01-17 09:34 - 00000000 ____D () C:\Program Files\CCleaner
2015-01-16 18:07 - 2015-01-16 18:08 - 13996300 _____ () C:\Users\Ronald\Downloads\MarsAttacksWS2013.2.8.zip
2015-01-16 14:43 - 2015-01-16 14:43 - 00000197 _____ () C:\Windows\system32\2015-01-16-13-43-31.019-AvastVBoxSVC.exe-3316.log
2015-01-16 14:27 - 2015-01-17 09:33 - 00000000 ____D () C:\Program Files (x86)\Visual Pinball
2015-01-16 14:25 - 2015-01-16 14:25 - 05827555 _____ () C:\Users\Ronald\Downloads\VPinball-9.1.5.zip
2015-01-16 14:23 - 2015-01-16 14:23 - 01179936 _____ () C:\Users\Ronald\Downloads\Visual Pinball - CHIP-Installer.exe
2015-01-14 11:39 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 11:39 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 11:39 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-01-14 11:39 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2015-01-14 11:39 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2015-01-14 11:39 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-01-14 11:39 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 11:39 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-01-14 11:39 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2015-01-14 11:39 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
2015-01-14 11:39 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-01-14 11:39 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-01-14 11:39 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-01-14 11:39 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-01-14 11:39 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2015-01-14 11:39 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
2015-01-14 11:39 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-01-14 11:39 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-01-14 11:39 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-01-14 11:39 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-01-14 11:39 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
2015-01-14 11:39 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-01-14 11:39 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-01-14 11:39 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 18:32 - 2015-01-13 18:32 - 00000000 __SHD () C:\Users\Ronald\AppData\Local\EmieBrowserModeList
2015-01-13 17:50 - 2015-01-13 17:50 - 00000000 ____D () C:\Users\Ronald\AppData\Local\AOP SDK
2015-01-13 17:00 - 2015-01-13 17:00 - 00000247 _____ () C:\Windows\system32\2015-01-13-16-00-44.072-aswFe.exe-2908.log
2015-01-13 16:55 - 2015-01-13 17:00 - 00000247 _____ () C:\Windows\system32\2015-01-13-15-55-37.058-aswFe.exe-3152.log
2015-01-13 16:55 - 2015-01-13 16:55 - 00000197 _____ () C:\Windows\system32\2015-01-13-15-55-34.025-AvastVBoxSVC.exe-1688.log
2015-01-13 13:35 - 2015-01-13 13:35 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\X Codec Pack 2.7.0 Xmas Edition
2015-01-13 13:35 - 2015-01-13 13:35 - 00000000 ____D () C:\Program Files\X Codec Pack
2015-01-13 13:34 - 2015-01-13 13:34 - 26068122 _____ () C:\Users\Ronald\Downloads\X-Codec-Pack-2.7.0-Xmas-Edition.exe
2015-01-13 13:24 - 2015-01-13 13:25 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\MAGIX
2015-01-13 13:24 - 2015-01-13 13:24 - 00000000 ____D () C:\Program Files\Common Files\MAGIX Shared
2015-01-13 13:16 - 2015-01-13 16:07 - 00000000 ___RD () C:\Users\Ronald\Documents\MAGIX
2015-01-13 13:16 - 2015-01-13 15:34 - 00000000 ____D () C:\ProgramData\MAGIX
2015-01-13 13:16 - 2015-01-13 13:16 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2015-01-13 13:10 - 2015-01-13 13:10 - 01179936 _____ () C:\Users\Ronald\Downloads\Magix Video Deluxe 2015 64 Bit - CHIP-Installer.exe
2015-01-13 12:02 - 2015-01-13 12:02 - 00000000 ____D () C:\Users\Ronald\AppData\RoamingDVDVideoSoft
2015-01-13 11:53 - 2015-01-13 11:54 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2015-01-13 11:53 - 2015-01-13 11:53 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\RHEng
2015-01-13 11:50 - 2015-01-13 16:42 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\DVDVideoSoft
2015-01-13 11:50 - 2015-01-13 11:50 - 03525136 _____ (DVDVideoSoft Ltd. ) C:\Users\Ronald\Downloads\FreeVideoEditor.exe
2015-01-08 09:14 - 2015-01-08 09:14 - 00000197 _____ () C:\Windows\system32\2015-01-08-08-14-43.066-AvastVBoxSVC.exe-2852.log
2015-01-07 13:11 - 2015-01-07 13:23 - 00003489 _____ () C:\InstallHelper.log
2015-01-07 13:10 - 2015-01-07 13:10 - 00000000 ____D () C:\ProgramData\eBay
2015-01-07 13:10 - 2015-01-07 13:10 - 00000000 ____D () C:\Program Files (x86)\eBay
2015-01-07 10:08 - 2015-01-21 15:51 - 00000000 ____D () C:\Users\Ronald\Documents\My PageManager
2015-01-07 10:08 - 2015-01-21 13:11 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\.oit
2015-01-07 10:08 - 2015-01-07 10:08 - 00002193 _____ () C:\Users\Public\Desktop\Presto! PageManager 9.03 SE.lnk
2015-01-07 10:08 - 2015-01-07 10:08 - 00000264 _____ () C:\Windows\setup.iss
2015-01-07 10:08 - 2015-01-07 10:08 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\NewSoft
2015-01-07 10:08 - 2015-01-07 10:08 - 00000000 ____D () C:\Users\Ronald\AppData\Local\NewSoft
2015-01-07 10:08 - 2015-01-07 10:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Presto! PageManager 9.03 Standard
2015-01-07 10:04 - 2001-09-10 18:05 - 00087392 _____ (Twain Working Group) C:\Windows\TWAIN.DLL
2015-01-07 10:04 - 2001-09-10 18:05 - 00069632 _____ (Twain Working Group) C:\Windows\Twunk_32.exe
2015-01-07 10:04 - 2001-09-10 18:05 - 00048560 _____ (Twain Working Group) C:\Windows\Twunk_16.exe
2015-01-07 10:04 - 1999-05-06 14:22 - 00027632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CTL3DV2.DLL
2015-01-07 10:03 - 2015-01-07 10:03 - 00000000 ____D () C:\Windows\SysWOW64\color
2015-01-07 10:03 - 2015-01-07 10:03 - 00000000 ____D () C:\Program Files (x86)\NewSoft
2015-01-07 09:37 - 2015-01-26 11:37 - 00000949 _____ () C:\Windows\Tasks\EPSON WF-3620 Series Update {13246269-553D-40F2-A8D7-B16731EBE536}.job
2015-01-07 09:37 - 2015-01-26 11:37 - 00000763 _____ () C:\Windows\Tasks\EPSON WF-3620 Series Invitation {13246269-553D-40F2-A8D7-B16731EBE536}.job
2015-01-07 09:37 - 2015-01-07 09:37 - 00003980 _____ () C:\Windows\System32\Tasks\EPSON WF-3620 Series Update {13246269-553D-40F2-A8D7-B16731EBE536}
2015-01-07 09:37 - 2015-01-07 09:37 - 00003794 _____ () C:\Windows\System32\Tasks\EPSON WF-3620 Series Invitation {13246269-553D-40F2-A8D7-B16731EBE536}
2015-01-07 09:36 - 2015-01-26 11:36 - 00000949 _____ () C:\Windows\Tasks\EPSON WF-3620 Series Update {EC877D19-896B-4AB9-A4B7-7E85763CA19A}.job
2015-01-07 09:36 - 2015-01-26 11:36 - 00000763 _____ () C:\Windows\Tasks\EPSON WF-3620 Series Invitation {EC877D19-896B-4AB9-A4B7-7E85763CA19A}.job
2015-01-07 09:36 - 2015-01-07 09:36 - 00003980 _____ () C:\Windows\System32\Tasks\EPSON WF-3620 Series Update {EC877D19-896B-4AB9-A4B7-7E85763CA19A}
2015-01-07 09:36 - 2015-01-07 09:36 - 00003794 _____ () C:\Windows\System32\Tasks\EPSON WF-3620 Series Invitation {EC877D19-896B-4AB9-A4B7-7E85763CA19A}
2015-01-01 19:01 - 2015-01-01 19:01 - 00000197 _____ () C:\Windows\system32\2015-01-01-18-01-52.030-AvastVBoxSVC.exe-2340.log
2015-01-01 17:05 - 2015-01-01 17:05 - 00000197 _____ () C:\Windows\system32\2015-01-01-16-05-16.081-AvastVBoxSVC.exe-2756.log
2014-12-30 21:39 - 2014-12-30 21:41 - 00000197 _____ () C:\Windows\system32\2014-12-30-20-39-53.043-AvastVBoxSVC.exe-3680.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-26 12:18 - 2014-10-13 15:23 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2227299661-2928916897-3466982639-1001
2015-01-26 12:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-01-26 11:38 - 2014-10-19 21:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-26 11:37 - 2014-10-15 09:35 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-26 11:36 - 2014-10-15 09:34 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-26 11:24 - 2014-10-13 22:35 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-26 11:07 - 2014-10-13 15:24 - 00000000 ____D () C:\Users\Ronald\AppData\Local\CrashDumps
2015-01-26 11:06 - 2014-10-15 09:26 - 00111616 ___SH () C:\Users\Ronald\Desktop\Thumbs.db
2015-01-26 11:05 - 2014-08-28 00:40 - 01790803 _____ () C:\Windows\WindowsUpdate.log
2015-01-26 10:57 - 2014-10-13 15:16 - 00000000 ____D () C:\Users\Ronald
2015-01-26 10:53 - 2014-10-13 15:22 - 00000000 ____D () C:\Users\Ronald\OneDrive
2015-01-26 10:49 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-26 10:48 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\InputMethod
2015-01-26 10:48 - 2013-08-22 14:25 - 00524288 ___SH () C:\Windows\system32\config\BBI
2015-01-26 10:01 - 2014-11-14 10:35 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\Anvsoft
2015-01-26 09:56 - 2014-10-13 22:35 - 00001082 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-26 09:56 - 2014-10-13 22:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-01-26 09:56 - 2014-10-13 22:35 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-01-26 09:34 - 2014-10-27 17:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson Software
2015-01-26 09:34 - 2014-10-27 17:18 - 00000000 ____D () C:\Program Files (x86)\Epson Software
2015-01-25 18:45 - 2014-10-13 15:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-25 17:38 - 2014-10-19 21:41 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-24 10:20 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-24 10:19 - 2014-07-25 22:20 - 00000000 ____D () C:\Program Files (x86)\Acer
2015-01-24 00:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\LiveKernelReports
2015-01-23 23:54 - 2014-07-25 22:21 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-23 23:51 - 2014-07-25 22:24 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-01-23 23:49 - 2014-07-25 22:23 - 00000000 ____D () C:\ProgramData\WildTangent
2015-01-23 23:49 - 2014-07-25 22:21 - 00000000 ____D () C:\Program Files (x86)\CyberLink
2015-01-23 23:44 - 2014-07-25 22:21 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2015-01-23 23:22 - 2014-10-14 20:02 - 00000000 ____D () C:\Users\Ronald\8Texte
2015-01-23 23:06 - 2014-10-13 23:11 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\vlc
2015-01-23 12:31 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-01-22 13:05 - 2014-10-15 10:00 - 00261120 ___SH () C:\Users\Ronald\Documents\Thumbs.db
2015-01-22 10:53 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-01-21 15:07 - 2014-10-27 17:15 - 00000954 _____ () C:\Users\Public\Desktop\EPSON Scan.lnk
2015-01-21 15:01 - 2014-10-27 16:10 - 00000000 ____D () C:\ProgramData\Epson
2015-01-20 11:23 - 2014-10-15 09:38 - 00000000 ____D () C:\Users\Ronald\.mediathek3
2015-01-20 10:28 - 2014-10-14 20:00 - 00000000 ____D () C:\Users\Ronald\Steuer
2015-01-19 22:32 - 2014-12-12 10:06 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-19 22:32 - 2014-10-13 21:55 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-19 14:42 - 2014-11-12 09:19 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular
2015-01-19 14:32 - 2014-07-25 22:21 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-17 09:40 - 2014-07-25 22:58 - 00000000 ____D () C:\Windows\Panther
2015-01-17 09:37 - 2014-10-13 22:06 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\Foxit Software
2015-01-16 18:26 - 2014-10-13 16:40 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-16 18:19 - 2014-10-13 16:40 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-16 14:40 - 2013-08-22 15:44 - 00499888 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-13 16:25 - 2014-10-13 15:31 - 00000000 ____D () C:\Users\Public\OEM
2015-01-13 15:56 - 2014-10-24 08:51 - 00000000 ____D () C:\Users\Ronald\Bewerbungen
2015-01-13 15:26 - 2014-10-14 20:08 - 00000000 ____D () C:\Users\Ronald\showreel
2015-01-13 13:29 - 2014-10-13 15:18 - 00000000 ____D () C:\Users\Ronald\AppData\Local\clear.fi
2015-01-13 13:19 - 2014-10-13 22:24 - 00000000 ____D () C:\Users\Ronald\AppData\Local\Windows Live
2015-01-13 11:53 - 2014-11-14 10:36 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2015-01-13 09:12 - 2014-10-13 15:20 - 00002172 _____ () C:\Users\Ronald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk
2015-01-13 08:17 - 2014-10-13 15:16 - 00000000 ____D () C:\Users\Ronald\AppData\Local\Pokki
2015-01-12 18:07 - 2014-10-14 20:03 - 00000000 ____D () C:\Users\Ronald\MediathekView
2015-01-09 17:30 - 2014-10-13 15:39 - 00000000 ____D () C:\Users\Ronald\AppData\Local\Microsoft Help
2015-01-07 13:08 - 2014-08-28 08:36 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2015-01-07 13:08 - 2014-08-28 08:36 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2015-01-07 13:08 - 2014-03-18 11:03 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-07 09:41 - 2014-10-20 09:29 - 00221184 ___SH () C:\Users\Ronald\Downloads\Thumbs.db
2015-01-07 09:20 - 2014-10-25 19:09 - 00000000 ____D () C:\Users\Ronald\AppData\Local\Abelssoft
2015-01-04 22:18 - 2014-11-03 21:31 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\dvdcss

==================== Files in the root of some directories =======

2014-10-15 09:20 - 2014-10-15 09:21 - 31470563 _____ () C:\Program Files (x86)\MediathekView_8.zip
2014-08-27 23:48 - 2014-08-27 23:48 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Ronald\AppData\Local\Temp\Quarantine.exe
C:\Users\Ronald\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

AdwCleaner auch löschen lassen.



ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

AdwCleaner Logfile:

# AdwCleaner v4.109 - Bericht erstellt am 26/01/2015 um 20:22:07
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-01-25.1 [Live]
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Ronald - NOTEBOOKRONNIE
# Gestartet von : C:\Users\Ronald\Downloads\AdwCleaner_4.109.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Ronald\AppData\Roaming\RHEng
Datei Gelöscht : C:\Windows\System32\roboot64.exe

***** [ Tasks ] *****

Task Gelöscht : ASP

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Classes\pokki
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Pokki]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Pokki
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v34.0.5 (x86 de)


*************************

AdwCleaner[R0].txt - [3140 octets] - [26/01/2015 12:03:32]
AdwCleaner[R1].txt - [3040 octets] - [26/01/2015 20:11:03]
AdwCleaner[S0].txt - [2436 octets] - [26/01/2015 20:22:07]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2496 octets] ##########
         

--- --- ---


SETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=8f8cfe6583fa4e438286291224824592
# engine=22156
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-26 09:44:50
# local_time=2015-01-26 10:44:50 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 95 1148377 9098269 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 6341389 27125458 0 0
# scanned=232976
# found=3
# cleaned=0
# scan_time=8095
sh=FA55D765ACECF0E142995558447BA1C0C64A95B9 ft=1 fh=8a5fed32a6adae19 vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=8ABE055DAC750D86B0E7E6C44E332CAA20B4A5A8 ft=1 fh=0639f6f4c29dc487 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Ronald\Downloads\Magix Video Deluxe 2015 64 Bit - CHIP-Installer.exe"
sh=5604D5790826857F0FA2087ECEEB6383CB665182 ft=1 fh=b3f86ea01242303d vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Ronald\Downloads\Visual Pinball - CHIP-Installer.exe"



Results of screen317's Security Check version 0.99.93
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Defender
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 25
Java 8 Update 31
Java version 32-bit out of Date!
Adobe Flash Player 16.0.0.296
Adobe Reader XI
Mozilla Firefox (34.0.5)
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast AvastSvc.exe
AVAST Software Avast ng vbox\AvastVBoxSVC.exe
AVAST Software Avast ng ngservice.exe
AVAST Software Avast avastui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by Ronald (administrator) on NOTEBOOKRONNIE on 26-01-2015 22:48:52
Running from C:\Users\Ronald\Downloads
Loaded Profiles: Ronald (Available profiles: Ronald)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMLockHandler.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAEvent.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAMsg.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerWinMonitor.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIKEE.EXE
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\RMSvc.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
() C:\Users\Ronald\Desktop\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672304 2014-03-21] (Realtek Semiconductor)
HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe [26448 2008-05-24] (NewSoft Technology Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-09] (AVAST Software)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [642664 2014-05-26] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [863848 2014-05-26] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1065024 2014-05-02] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [PMSpeed] => C:\Program Files (x86)\NewSoft\Presto! PageManager 9.03\PMSpeed.EXE [116632 2010-07-29] (NewSoft Technology Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Run: [dradio-RecorderTimer] => C:\Program Files (x86)\dradio-Recorder\phonostarTimer.exe [42496 2012-10-13] ()
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIKEE.EXE [298560 2013-09-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIKEE.EXE [298560 2013-09-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Run: [Scan Buttons] => C:\Program Files (x86)\NewSoft\Presto! PageManager 9.03\Pmsb.exe [214360 2011-01-21] (NewSoft Technology Corporation)
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Ronald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BUFFALO NAS Navigator2.lnk
ShortcutTarget: BUFFALO NAS Navigator2.lnk -> C:\Program Files (x86)\BUFFALO\NASNAVI\NasNavi.exe (BUFFALO INC.)
Startup: C:\Users\Ronald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NAS Scheduler.lnk
ShortcutTarget: NAS Scheduler.lnk -> C:\Program Files (x86)\BUFFALO\NASNAVI\nassche.exe (BUFFALO INC.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [ACloudSyncedRF] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated)
ShellIconOverlayIdentifiers: [ACloudSyncedSF] -> {5D5F18B7-D59B-4B18-A3E9-0A4BDCCCB699} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated)
ShellIconOverlayIdentifiers: [ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated)
ShellIconOverlayIdentifiers: [ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com/?pc=ACJB
HKU\S-1-5-21-2227299661-2928916897-3466982639-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2227299661-2928916897-3466982639-1001 -> {79C55BEB-84AF-4D47-A092-51AC4DD4F71A} URL = 
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\4jw3roga.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2227299661-2928916897-3466982639-1001: @phonostar.de/phonostar -> C:\Program Files (x86)\dradio-Recorder\npphonostarDetectNP.dll No File
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-10-13]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-07]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-07] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-07] (Avast Software)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2251992 2013-11-14] (Broadcom Corporation.)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2573032 2014-06-12] (Acer Incorporated)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [315352 2014-05-30] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [466664 2014-06-10] (Acer Incorporate)
R2 NasPmService; C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe [251184 2009-05-15] (BUFFALO INC.)
R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [458984 2014-06-26] (Acer Incorporate)
R3 RMSvc; C:\Program Files\Acer\Acer Quick Access\RMSvc.exe [449768 2014-06-26] (Acer Incorporate)
R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [234240 2014-07-15] (acer)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-07] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-07] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-07] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-07] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-07] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-07] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-07] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-07] ()
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-11-14] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7549616 2014-02-25] (Broadcom Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R3 ETDI2C; C:\Windows\system32\DRIVERS\ETDI2C.sys [173384 2014-04-09] (ELAN Microelectronic Corp.)
S3 GPIO; C:\Windows\System32\drivers\iaiogpioe.sys [31232 2013-11-11] (Intel Corporation)
R3 iaioi2c; C:\Windows\System32\drivers\iaioi2ce.sys [67584 2013-11-11] (Intel Corporation)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [461528 2013-12-20] (Realsil Semiconductor Corporation)
U5 TMUSB; C:\Windows\System32\DRIVERS\TMUSB64.SYS [63096 2013-10-29] (Seiko Epson Corporation)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-07] (Avast Software)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-26 22:47 - 2015-01-26 22:47 - 00852504 _____ () C:\Users\Ronald\Desktop\SecurityCheck.exe
2015-01-26 20:27 - 2015-01-26 20:27 - 02347384 _____ (ESET) C:\Users\Ronald\Downloads\esetsmartinstaller_deu.exe
2015-01-26 20:23 - 2015-01-26 20:23 - 00000197 _____ () C:\Windows\system32\2015-01-26-19-23-47.031-AvastVBoxSVC.exe-2260.log
2015-01-26 15:20 - 2015-01-26 15:20 - 00000197 _____ () C:\Windows\system32\2015-01-26-14-20-11.029-AvastVBoxSVC.exe-2332.log
2015-01-26 15:17 - 2015-01-26 20:23 - 00000664 _____ () C:\Windows\PFRO.log
2015-01-26 15:17 - 2015-01-26 20:23 - 00000232 _____ () C:\Windows\setupact.log
2015-01-26 15:17 - 2015-01-26 15:17 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-26 12:17 - 2015-01-26 12:17 - 00000936 _____ () C:\Users\Ronald\Desktop\JRT.txt
2015-01-26 12:09 - 2015-01-26 12:09 - 01707939 _____ (Thisisu) C:\Users\Ronald\Downloads\JRT.exe
2015-01-26 12:09 - 2015-01-26 12:09 - 00000000 ____D () C:\Windows\ERUNT
2015-01-26 12:03 - 2015-01-26 20:22 - 00000000 ____D () C:\AdwCleaner
2015-01-26 12:02 - 2015-01-26 12:02 - 02194432 _____ () C:\Users\Ronald\Downloads\AdwCleaner_4.109.exe
2015-01-26 12:00 - 2015-01-26 12:00 - 00001191 _____ () C:\Users\Ronald\Desktop\mbam.txt
2015-01-26 11:05 - 2015-01-26 11:05 - 00380416 _____ () C:\Users\Ronald\Downloads\7xmlgwi0.exe
2015-01-26 11:00 - 2015-01-26 11:01 - 00032517 _____ () C:\Users\Ronald\Downloads\Addition.txt
2015-01-26 10:58 - 2015-01-26 22:48 - 00015830 _____ () C:\Users\Ronald\Downloads\FRST.txt
2015-01-26 10:58 - 2015-01-26 22:48 - 00000000 ____D () C:\FRST
2015-01-26 10:58 - 2015-01-26 10:58 - 02129920 _____ (Farbar) C:\Users\Ronald\Downloads\FRST64.exe
2015-01-26 10:57 - 2015-01-26 10:57 - 00000474 _____ () C:\Users\Ronald\Downloads\defogger_disable.log
2015-01-26 10:57 - 2015-01-26 10:57 - 00000000 _____ () C:\Users\Ronald\defogger_reenable
2015-01-26 10:56 - 2015-01-26 10:56 - 00050477 _____ () C:\Users\Ronald\Downloads\Defogger.exe
2015-01-26 10:51 - 2015-01-26 10:53 - 00000197 _____ () C:\Windows\system32\2015-01-26-09-51-35.011-AvastVBoxSVC.exe-2376.log
2015-01-26 09:54 - 2015-01-26 09:54 - 00544303 _____ () C:\Users\Ronald\Downloads\noscript_security_suite-2.6.9.11-sm_fn_fx.xpi
2015-01-24 10:17 - 2015-01-24 10:17 - 00000197 _____ () C:\Windows\system32\2015-01-24-09-17-19.081-AvastVBoxSVC.exe-3004.log
2015-01-23 23:49 - 2015-01-23 23:49 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\WildTangent
2015-01-20 10:54 - 2015-01-20 10:59 - 00000000 ____D () C:\Users\Ronald\AppData\Local\.elfohilfe
2015-01-19 14:30 - 2015-01-19 14:38 - 00000000 ____D () C:\Users\Ronald\AppData\Local\elfopatch
2015-01-17 09:34 - 2015-01-17 09:34 - 04188536 _____ (Piriform Ltd) C:\Users\Ronald\Downloads\ccsetup501_slim.exe
2015-01-17 09:34 - 2015-01-17 09:34 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-01-17 09:34 - 2015-01-17 09:34 - 00000838 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-01-17 09:34 - 2015-01-17 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-01-17 09:34 - 2015-01-17 09:34 - 00000000 ____D () C:\Program Files\CCleaner
2015-01-16 18:07 - 2015-01-16 18:08 - 13996300 _____ () C:\Users\Ronald\Downloads\MarsAttacksWS2013.2.8.zip
2015-01-16 14:43 - 2015-01-16 14:43 - 00000197 _____ () C:\Windows\system32\2015-01-16-13-43-31.019-AvastVBoxSVC.exe-3316.log
2015-01-16 14:27 - 2015-01-17 09:33 - 00000000 ____D () C:\Program Files (x86)\Visual Pinball
2015-01-16 14:25 - 2015-01-16 14:25 - 05827555 _____ () C:\Users\Ronald\Downloads\VPinball-9.1.5.zip
2015-01-16 14:23 - 2015-01-16 14:23 - 01179936 _____ () C:\Users\Ronald\Downloads\Visual Pinball - CHIP-Installer.exe
2015-01-14 11:39 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 11:39 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 11:39 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-01-14 11:39 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-01-14 11:39 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2015-01-14 11:39 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2015-01-14 11:39 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-01-14 11:39 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 11:39 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-01-14 11:39 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2015-01-14 11:39 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
2015-01-14 11:39 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-01-14 11:39 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-01-14 11:39 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-01-14 11:39 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-01-14 11:39 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2015-01-14 11:39 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
2015-01-14 11:39 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-01-14 11:39 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-01-14 11:39 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-01-14 11:39 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-01-14 11:39 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
2015-01-14 11:39 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-01-14 11:39 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-01-14 11:39 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 18:32 - 2015-01-13 18:32 - 00000000 __SHD () C:\Users\Ronald\AppData\Local\EmieBrowserModeList
2015-01-13 17:50 - 2015-01-13 17:50 - 00000000 ____D () C:\Users\Ronald\AppData\Local\AOP SDK
2015-01-13 17:00 - 2015-01-13 17:00 - 00000247 _____ () C:\Windows\system32\2015-01-13-16-00-44.072-aswFe.exe-2908.log
2015-01-13 16:55 - 2015-01-13 17:00 - 00000247 _____ () C:\Windows\system32\2015-01-13-15-55-37.058-aswFe.exe-3152.log
2015-01-13 16:55 - 2015-01-13 16:55 - 00000197 _____ () C:\Windows\system32\2015-01-13-15-55-34.025-AvastVBoxSVC.exe-1688.log
2015-01-13 13:35 - 2015-01-13 13:35 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\X Codec Pack 2.7.0 Xmas Edition
2015-01-13 13:35 - 2015-01-13 13:35 - 00000000 ____D () C:\Program Files\X Codec Pack
2015-01-13 13:34 - 2015-01-13 13:34 - 26068122 _____ () C:\Users\Ronald\Downloads\X-Codec-Pack-2.7.0-Xmas-Edition.exe
2015-01-13 13:24 - 2015-01-13 13:25 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\MAGIX
2015-01-13 13:24 - 2015-01-13 13:24 - 00000000 ____D () C:\Program Files\Common Files\MAGIX Shared
2015-01-13 13:16 - 2015-01-13 16:07 - 00000000 ___RD () C:\Users\Ronald\Documents\MAGIX
2015-01-13 13:16 - 2015-01-13 15:34 - 00000000 ____D () C:\ProgramData\MAGIX
2015-01-13 13:16 - 2015-01-13 13:16 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2015-01-13 13:10 - 2015-01-13 13:10 - 01179936 _____ () C:\Users\Ronald\Downloads\Magix Video Deluxe 2015 64 Bit - CHIP-Installer.exe
2015-01-13 12:02 - 2015-01-13 12:02 - 00000000 ____D () C:\Users\Ronald\AppData\RoamingDVDVideoSoft
2015-01-13 11:53 - 2015-01-13 11:54 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2015-01-13 11:50 - 2015-01-13 16:42 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\DVDVideoSoft
2015-01-13 11:50 - 2015-01-13 11:50 - 03525136 _____ (DVDVideoSoft Ltd. ) C:\Users\Ronald\Downloads\FreeVideoEditor.exe
2015-01-08 09:14 - 2015-01-08 09:14 - 00000197 _____ () C:\Windows\system32\2015-01-08-08-14-43.066-AvastVBoxSVC.exe-2852.log
2015-01-07 13:11 - 2015-01-07 13:23 - 00003489 _____ () C:\InstallHelper.log
2015-01-07 13:10 - 2015-01-07 13:10 - 00000000 ____D () C:\ProgramData\eBay
2015-01-07 13:10 - 2015-01-07 13:10 - 00000000 ____D () C:\Program Files (x86)\eBay
2015-01-07 10:08 - 2015-01-21 15:51 - 00000000 ____D () C:\Users\Ronald\Documents\My PageManager
2015-01-07 10:08 - 2015-01-21 13:11 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\.oit
2015-01-07 10:08 - 2015-01-07 10:08 - 00002193 _____ () C:\Users\Public\Desktop\Presto! PageManager 9.03 SE.lnk
2015-01-07 10:08 - 2015-01-07 10:08 - 00000264 _____ () C:\Windows\setup.iss
2015-01-07 10:08 - 2015-01-07 10:08 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\NewSoft
2015-01-07 10:08 - 2015-01-07 10:08 - 00000000 ____D () C:\Users\Ronald\AppData\Local\NewSoft
2015-01-07 10:08 - 2015-01-07 10:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Presto! PageManager 9.03 Standard
2015-01-07 10:04 - 2001-09-10 18:05 - 00087392 _____ (Twain Working Group) C:\Windows\TWAIN.DLL
2015-01-07 10:04 - 2001-09-10 18:05 - 00069632 _____ (Twain Working Group) C:\Windows\Twunk_32.exe
2015-01-07 10:04 - 2001-09-10 18:05 - 00048560 _____ (Twain Working Group) C:\Windows\Twunk_16.exe
2015-01-07 10:04 - 1999-05-06 14:22 - 00027632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CTL3DV2.DLL
2015-01-07 10:03 - 2015-01-07 10:03 - 00000000 ____D () C:\Windows\SysWOW64\color
2015-01-07 10:03 - 2015-01-07 10:03 - 00000000 ____D () C:\Program Files (x86)\NewSoft
2015-01-07 09:37 - 2015-01-26 22:37 - 00000949 _____ () C:\Windows\Tasks\EPSON WF-3620 Series Update {13246269-553D-40F2-A8D7-B16731EBE536}.job
2015-01-07 09:37 - 2015-01-26 22:37 - 00000763 _____ () C:\Windows\Tasks\EPSON WF-3620 Series Invitation {13246269-553D-40F2-A8D7-B16731EBE536}.job
2015-01-07 09:37 - 2015-01-07 09:37 - 00003980 _____ () C:\Windows\System32\Tasks\EPSON WF-3620 Series Update {13246269-553D-40F2-A8D7-B16731EBE536}
2015-01-07 09:37 - 2015-01-07 09:37 - 00003794 _____ () C:\Windows\System32\Tasks\EPSON WF-3620 Series Invitation {13246269-553D-40F2-A8D7-B16731EBE536}
2015-01-07 09:36 - 2015-01-26 22:36 - 00000949 _____ () C:\Windows\Tasks\EPSON WF-3620 Series Update {EC877D19-896B-4AB9-A4B7-7E85763CA19A}.job
2015-01-07 09:36 - 2015-01-26 22:36 - 00000763 _____ () C:\Windows\Tasks\EPSON WF-3620 Series Invitation {EC877D19-896B-4AB9-A4B7-7E85763CA19A}.job
2015-01-07 09:36 - 2015-01-07 09:36 - 00003980 _____ () C:\Windows\System32\Tasks\EPSON WF-3620 Series Update {EC877D19-896B-4AB9-A4B7-7E85763CA19A}
2015-01-07 09:36 - 2015-01-07 09:36 - 00003794 _____ () C:\Windows\System32\Tasks\EPSON WF-3620 Series Invitation {EC877D19-896B-4AB9-A4B7-7E85763CA19A}
2015-01-01 19:01 - 2015-01-01 19:01 - 00000197 _____ () C:\Windows\system32\2015-01-01-18-01-52.030-AvastVBoxSVC.exe-2340.log
2015-01-01 17:05 - 2015-01-01 17:05 - 00000197 _____ () C:\Windows\system32\2015-01-01-16-05-16.081-AvastVBoxSVC.exe-2756.log
2014-12-30 21:39 - 2014-12-30 21:41 - 00000197 _____ () C:\Windows\system32\2014-12-30-20-39-53.043-AvastVBoxSVC.exe-3680.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-26 22:38 - 2014-10-19 21:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-26 22:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-01-26 21:25 - 2014-08-28 00:40 - 02006206 _____ () C:\Windows\WindowsUpdate.log
2015-01-26 20:25 - 2014-10-13 15:22 - 00000000 ____D () C:\Users\Ronald\OneDrive
2015-01-26 20:23 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-26 15:17 - 2013-08-22 14:25 - 00524288 ___SH () C:\Windows\system32\config\BBI
2015-01-26 12:18 - 2014-10-13 15:23 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2227299661-2928916897-3466982639-1001
2015-01-26 11:37 - 2014-10-15 09:35 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-26 11:36 - 2014-10-15 09:34 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-26 11:24 - 2014-10-13 22:35 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-26 11:07 - 2014-10-13 15:24 - 00000000 ____D () C:\Users\Ronald\AppData\Local\CrashDumps
2015-01-26 11:06 - 2014-10-15 09:26 - 00111616 ___SH () C:\Users\Ronald\Desktop\Thumbs.db
2015-01-26 10:57 - 2014-10-13 15:16 - 00000000 ____D () C:\Users\Ronald
2015-01-26 10:48 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\InputMethod
2015-01-26 10:01 - 2014-11-14 10:35 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\Anvsoft
2015-01-26 09:56 - 2014-10-13 22:35 - 00001082 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-26 09:56 - 2014-10-13 22:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-26 09:56 - 2014-10-13 22:35 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-26 09:34 - 2014-10-27 17:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson Software
2015-01-26 09:34 - 2014-10-27 17:18 - 00000000 ____D () C:\Program Files (x86)\Epson Software
2015-01-25 18:45 - 2014-10-13 15:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-25 17:38 - 2014-10-19 21:41 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-24 10:20 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-24 10:19 - 2014-07-25 22:20 - 00000000 ____D () C:\Program Files (x86)\Acer
2015-01-24 00:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\LiveKernelReports
2015-01-23 23:54 - 2014-07-25 22:21 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-23 23:51 - 2014-07-25 22:24 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-01-23 23:49 - 2014-07-25 22:23 - 00000000 ____D () C:\ProgramData\WildTangent
2015-01-23 23:49 - 2014-07-25 22:21 - 00000000 ____D () C:\Program Files (x86)\CyberLink
2015-01-23 23:44 - 2014-07-25 22:21 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2015-01-23 23:22 - 2014-10-14 20:02 - 00000000 ____D () C:\Users\Ronald\8Texte
2015-01-23 23:06 - 2014-10-13 23:11 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\vlc
2015-01-23 12:31 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-01-22 13:05 - 2014-10-15 10:00 - 00261120 ___SH () C:\Users\Ronald\Documents\Thumbs.db
2015-01-22 10:53 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-01-21 15:07 - 2014-10-27 17:15 - 00000954 _____ () C:\Users\Public\Desktop\EPSON Scan.lnk
2015-01-21 15:01 - 2014-10-27 16:10 - 00000000 ____D () C:\ProgramData\Epson
2015-01-20 11:23 - 2014-10-15 09:38 - 00000000 ____D () C:\Users\Ronald\.mediathek3
2015-01-20 10:28 - 2014-10-14 20:00 - 00000000 ____D () C:\Users\Ronald\Steuer
2015-01-19 22:32 - 2014-12-12 10:06 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-19 22:32 - 2014-10-13 21:55 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-19 14:42 - 2014-11-12 09:19 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular
2015-01-19 14:32 - 2014-07-25 22:21 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-17 09:40 - 2014-07-25 22:58 - 00000000 ____D () C:\Windows\Panther
2015-01-17 09:37 - 2014-10-13 22:06 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\Foxit Software
2015-01-16 18:26 - 2014-10-13 16:40 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-16 18:19 - 2014-10-13 16:40 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-16 14:40 - 2013-08-22 15:44 - 00499888 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-13 16:25 - 2014-10-13 15:31 - 00000000 ____D () C:\Users\Public\OEM
2015-01-13 15:56 - 2014-10-24 08:51 - 00000000 ____D () C:\Users\Ronald\Bewerbungen
2015-01-13 15:26 - 2014-10-14 20:08 - 00000000 ____D () C:\Users\Ronald\showreel
2015-01-13 13:29 - 2014-10-13 15:18 - 00000000 ____D () C:\Users\Ronald\AppData\Local\clear.fi
2015-01-13 13:19 - 2014-10-13 22:24 - 00000000 ____D () C:\Users\Ronald\AppData\Local\Windows Live
2015-01-13 11:53 - 2014-11-14 10:36 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2015-01-13 09:12 - 2014-10-13 15:20 - 00002172 _____ () C:\Users\Ronald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk
2015-01-13 08:17 - 2014-10-13 15:16 - 00000000 ____D () C:\Users\Ronald\AppData\Local\Pokki
2015-01-12 18:07 - 2014-10-14 20:03 - 00000000 ____D () C:\Users\Ronald\MediathekView
2015-01-09 17:30 - 2014-10-13 15:39 - 00000000 ____D () C:\Users\Ronald\AppData\Local\Microsoft Help
2015-01-07 13:08 - 2014-08-28 08:36 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2015-01-07 13:08 - 2014-08-28 08:36 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2015-01-07 13:08 - 2014-03-18 11:03 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-07 09:41 - 2014-10-20 09:29 - 00221184 ___SH () C:\Users\Ronald\Downloads\Thumbs.db
2015-01-07 09:20 - 2014-10-25 19:09 - 00000000 ____D () C:\Users\Ronald\AppData\Local\Abelssoft
2015-01-04 22:18 - 2014-11-03 21:31 - 00000000 ____D () C:\Users\Ronald\AppData\Roaming\dvdcss

==================== Files in the root of some directories =======

2014-10-15 09:20 - 2014-10-15 09:21 - 31470563 _____ () C:\Program Files (x86)\MediathekView_8.zip
2014-08-27 23:48 - 2014-08-27 23:48 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Ronald\AppData\Local\Temp\Quarantine.exe
C:\Users\Ronald\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-26 10:31

==================== End Of Log ============================
         

--- --- ---

--- --- ---


Soll ich jetzt noch was tun?
Habe das Gefühl das Notebook ist auf jeden Fall wieder schneller geworden.

Fertig

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Also den CCleaner schmeiße ich wieder raus, ja?

Die Add-ons hab ich mir installiert, Anti-Malware habe ich eh, den tfc ab und an mal benutzen und Software aktuell halten (macht AVAST bei mir), das reicht?

Nochmals vielen Dank für Deine professionelle und schnelle Hilfe.

Wenn Du keine weiteren Anmerkungen mehr hast, dann kannst Du den Thread bzw. Dein Abo hierauf löschen.
DANKE!

Ccleaner kannste auch behalten für die Temps, nur nix mit der Registry machen


Gern Geschehen