Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Meldung in Win7: Der Proxyserver reagiert nicht

Meldung in Win7: Der Proxyserver reagiert nicht


Plagegeister aller Art und deren Bekämpfung: Meldung in Win7: Der Proxyserver reagiert nicht

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 1 von 2 1 2
Alt 28.01.2015, 23:19   #1
BerndFranzen
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Meldung in Win7: Der Proxyserver reagiert nicht


Seit ein paar Tagen erhalte ich beim Aufruf der Seiten <freemail.de> und <Facebook.de> die Meldung "Der Proxyserver reagiert nicht". Andere Seiten lassen sich aufrufen.
Außerdem erscheinen vermehrt lästige PopUps.
Ich habe schon einige der Tools, die hier für einen Neueinstieg genannt wurden, laufen lassen.

Alt 28.01.2015, 23:24   #2
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Meldung in Win7: Der Proxyserver reagiert nicht




Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
  • Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
  • Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
  • Poste die Logfiles direkt in Deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean bekommst.



Los geht's:

Schritt 1


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)




Lesestoff
Posten in CODE-Tags: So gehts...
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________
Alt 29.01.2015, 12:45   #3
BerndFranzen
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Schonmal Danke


Hallo Jürgen,

Danke für deinen Einsatz. Ich werde in den nächsten Tagen leider wenig Zeit für die Bereinigung aufbringen können, kann dir aber versprechen, dass der Rechner in dieser Zeit auch ruhig in der Ecke liegen wird; es gibt ein Leben neben dem Laptop. Noch habe ich Zeit und Geduld für die Reparatur, ganz speziell dann, wenn mir jemand helfen will.

Bernd
__________________
Alt 29.01.2015, 13:06   #4
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Meldung in Win7: Der Proxyserver reagiert nicht


Alles klar.
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 30.01.2015, 20:25   #5
BerndFranzen
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Jetzt kanns losgehen


Hier zuerst das Ergebnis von FRST64

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015
Ran by bfzn (ATTENTION: The logged in user is not administrator) on SEVENUP on 30-01-2015 20:18:11
Running from C:\Users\bfzn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RRM2JF02
Loaded Profiles: bfzn (Available profiles: bfzadm & bfzn)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIGAE.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Users\bfzadm\AppData\Local\ConvertAd\ConvertAd.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_16_0_0_296_ActiveX.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
(Farbar) C:\Users\bfzn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RRM2JF02\FRST64 (1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [HPPowerAssistant] => C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1691192 2010-06-19] (Hewlett-Packard Company)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-03-17] (IDT, Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-06-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-03-01] (Hewlett-Packard Company)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-04] (Intel Corporation)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [563736 2009-10-23] (PDF Complete Inc)
HKLM-x32\...\Run: [File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11265536 2009-12-12] (Hewlett-Packard)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DTRun] => c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [518656 2009-11-18] (ArcSoft Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [600936 2009-06-29] (Symantec Corporation)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3674576 2015-01-06] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [724576 2012-08-20] (Sony Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKU\S-1-5-21-2226251454-2989245828-1209764460-1004\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company)
HKU\S-1-5-21-2226251454-2989245828-1209764460-1004\...\Run: [Epson Stylus SX525WD(Netzwerk)] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGAE.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [301568 2014-12-02] (Microsoft Corporation)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52515;https=127.0.0.1:52515
ProxyEnable: [S-1-5-21-2226251454-2989245828-1209764460-1004] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-2226251454-2989245828-1209764460-1004] => http=127.0.0.1:52515;https=127.0.0.1:52515
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
HKU\S-1-5-21-2226251454-2989245828-1209764460-1004\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKU\S-1-5-21-2226251454-2989245828-1209764460-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
SearchScopes: HKLM -> {AA5CC064-C92C-4050-82FD-3CA90F36F4FF} URL = hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ir_14_48_ie&cd=2XzuyEtN2Y1L1Qzu0EtDtB0AzztB0A0DyByCyEtD0FtAyC0BtN0D0Tzu0StCtDyCtAtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1BtN1L1G1B1V1N2Y1L1Qzu2StC0C0FyE0FyD0EyDtGyByDyB0DtGyD0F0C0EtGzy0CyE0BtGyC0C0A0AyBzyzy0AyD0D0Czz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtD0AyC0E0CtDtDtG0ByBzytCtGyE0D0BtBtGzyzzzyzztGtByC0Azz0D0CtCyByB0AyByC2Q&cr=1746014680&ir=
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
SearchScopes: HKLM-x32 -> {AA5CC064-C92C-4050-82FD-3CA90F36F4FF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2226251454-2989245828-1209764460-1004 -> DefaultScope {AA5CC064-C92C-4050-82FD-3CA90F36F4FF} URL = 
SearchScopes: HKU\S-1-5-21-2226251454-2989245828-1209764460-1004 -> {AF0C3425-2B00-44B5-A39D-C644774ADC84} URL = https://www.google.com/search?q={searchTerms}
BHO: HP ProtectTools Security Manager Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\XTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: HP ProtectTools Security Manager Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-2226251454-2989245828-1209764460-1004 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\windows\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)
Winsock: Catalog9 02 C:\windows\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)
Winsock: Catalog9 03 C:\windows\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)
Winsock: Catalog9 04 C:\windows\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)
Winsock: Catalog9 16 C:\windows\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)
Winsock: Catalog9-x64 01 C:\windows\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)
Winsock: Catalog9-x64 02 C:\windows\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)
Winsock: Catalog9-x64 03 C:\windows\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)
Winsock: Catalog9-x64 04 C:\windows\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)
Winsock: Catalog9-x64 16 C:\windows\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2010-12-07]

Chrome: 
=======
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Presentaciones de Google) - C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-28]
CHR Extension: (Google Docs) - C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-28]
CHR Extension: (Hojas de cálculo de Google) - C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-28]
CHR Extension: (Google Wallet) - C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-29]
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://istart.webssearches.com/?type=sc&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-17] (Adobe Systems Incorporated)
R2 AESTFilters; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3440080 2015-01-06] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [309232 2015-01-06] (AVG Technologies CZ, s.r.o.)
R2 ColorMedia; C:\ProgramData\SecurityUtility\ColorMedia.exe [1844232 2015-01-27] (CartCrunch Israel Ltd.) [File not signed]
R3 DEBridge; c:\Program Files\Hewlett-Packard\Drive Encryption\SbHpAuthenticatorService.exe [704512 2009-12-16] (McAfee, Inc.) [File not signed]
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [462088 2009-11-25] (DigitalPersona, Inc.)
R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed]
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [362040 2009-11-17] (Hewlett-Packard Ltd)
R2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [121344 2010-07-01] (Hewlett-Packard Company) [File not signed]
R2 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2009-11-19] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP QuickLook\32-bit\HPDayStarterService.exe [90112 2010-05-10] (Hewlett-Packard Company) [File not signed]
R2 HpFkCryptService; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2009-12-16] (McAfee, Inc.)
R2 HPFSService; C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [297984 2009-12-12] (Hewlett-Packard) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [264248 2010-03-01] (Hewlett-Packard Company)
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158896 2015-01-16] (XTab system)
R2 Internet Enhancer Service; C:\Program Files (x86)\WIntEnhance\WIntEnhance Internet Enhancer\InternetEnhancerService.exe [463872 2015-01-22] () [File not signed]
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-06-17] (Hewlett-Packard Company) [File not signed]
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [635416 2009-10-23] (PDF Complete Inc)
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474208 2012-08-20] (Sony Corporation)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] ()
R2 serversu; C:\Users\bfzadm\AppData\Roaming\SoftwareUpdater\SUsrv.exe [0 ] () <==== ATTENTION (zero size file/folder)
R2 STacSV; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe [244736 2010-03-17] (IDT, Inc.)
R2 uArcCapture; C:\windows\system\uArcCapture.exe [506472 2009-12-04] (ArcSoft, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 serverca; C:\Users\bfzadm\AppData\Local\ConvertAd\CASrv.exe [X]
R2 servervo; C:\Users\bfzadm\AppData\Roaming\VOPackage\VOsrv.exe [X] <==== ATTENTION

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32640 2009-12-04] (ArcSoft, Inc.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [40760 2009-10-21] (Hewlett-Packard Development Company L.P.)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
R1 RsvLock; C:\Windows\System32\Drivers\RsvLock.sys [58184 2009-12-16] (McAfee, Inc.)
R1 RsvLock; C:\Windows\SysWow64\Drivers\RsvLock.sys [40088 2009-12-16] (McAfee, Inc.)
R0 SafeBoot; C:\Windows\System32\Drivers\SafeBoot.sys [56648 2009-12-16] ()
R0 SafeBoot; C:\Windows\SysWow64\Drivers\SafeBoot.sys [110520 2009-12-16] (McAfee, Inc.)
R0 SbAlg; C:\Windows\System32\Drivers\SbAlg.sys [60160 2009-06-04] (McAfee, Inc.)
R0 SbAlg; C:\Windows\SysWow64\Drivers\SbAlg.sys [51800 2009-12-16] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\System32\Drivers\SbFsLock.sys [15688 2009-12-16] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\SysWow64\Drivers\SbFsLock.sys [13256 2009-12-16] (McAfee, Inc.)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1803904 2010-10-13] ()

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-28 23:02 - 2015-01-28 23:03 - 00020928 _____ () C:\Users\bfzn\Desktop\Result.txt
2015-01-28 22:22 - 2015-01-30 20:18 - 00000000 ____D () C:\FRST
2015-01-28 22:20 - 2015-01-28 22:20 - 00000474 _____ () C:\Users\bfzn\Desktop\defogger_disable.log
2015-01-28 22:20 - 2015-01-28 22:20 - 00000000 _____ () C:\Users\bfzadm\defogger_reenable
2015-01-28 21:21 - 2015-01-28 21:21 - 00000000 ___HD () C:\windows\msdownld.tmp
2015-01-28 19:19 - 2015-01-28 19:19 - 00000000 ____D () C:\Users\bfzadm\AppData\Roaming\Apple Computer
2015-01-27 21:39 - 2015-01-27 21:39 - 00002607 _____ () C:\Users\Public\Desktop\HNK für Excel.lnk
2015-01-27 21:39 - 2015-01-27 21:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Heiz- und Nebenkosten
2015-01-27 21:39 - 2015-01-27 21:39 - 00000000 ____D () C:\Program Files (x86)\KV Software
2015-01-27 21:18 - 2015-01-30 20:12 - 00000000 ____D () C:\Users\bfzadm\AppData\Roaming\SoftwareUpdater
2015-01-27 21:17 - 2015-01-27 21:17 - 00000000 ____D () C:\Temp
2015-01-27 21:16 - 2015-01-27 21:16 - 00000000 ____D () C:\Users\bfzadm\AppData\Roaming\dlg
2015-01-27 21:15 - 2015-01-27 21:20 - 00000000 ____D () C:\Users\bfzadm\AppData\Roaming\VOPackage
2015-01-27 21:14 - 2015-01-30 20:07 - 00005264 _____ () C:\windows\SysWOW64\ColorMedia.ini
2015-01-27 21:14 - 2015-01-30 20:07 - 00002864 _____ () C:\windows\SysWOW64\ColorMediaOff.ini
2015-01-27 21:14 - 2015-01-30 20:07 - 00002864 _____ () C:\windows\system32\ColorMediaOff.ini
2015-01-27 21:14 - 2015-01-30 20:07 - 00000000 ____D () C:\ProgramData\SecurityUtility
2015-01-27 21:14 - 2015-01-27 21:14 - 00000000 ____D () C:\ProgramData\SecurityUtilityData
2015-01-27 21:14 - 2015-01-27 21:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WIntEnhance
2015-01-27 21:14 - 2015-01-27 21:14 - 00000000 ____D () C:\Program Files (x86)\WIntEnhance
2015-01-27 21:14 - 2015-01-27 21:14 - 00000000 ____D () C:\Program Files (x86)\Wajam
2015-01-27 21:14 - 2015-01-27 17:31 - 00344440 _____ (CartCrunch Israel Ltd.) C:\windows\system32\ColorMedia64.dll
2015-01-27 21:14 - 2015-01-27 17:31 - 00301168 _____ (CartCrunch Israel Ltd.) C:\windows\SysWOW64\ColorMedia.dll
2015-01-27 21:13 - 2015-01-27 21:20 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2015-01-27 21:13 - 2015-01-27 21:13 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
2015-01-27 21:13 - 2015-01-27 21:13 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-01-26 18:33 - 2015-01-26 18:33 - 480951400 _____ () C:\windows\MEMORY.DMP
2015-01-26 18:33 - 2015-01-26 18:33 - 00000000 ____D () C:\windows\Minidump
2015-01-23 21:04 - 2015-01-23 21:18 - 00000000 ____D () C:\Program Files (x86)\No23 Recorder
2015-01-23 21:04 - 2015-01-23 21:04 - 00001061 _____ () C:\Users\Public\Desktop\No23 Recorder.lnk
2015-01-23 21:04 - 2015-01-23 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\No23 Recorder
2015-01-23 21:04 - 2015-01-23 21:04 - 00000000 ____D () C:\ProgramData\Caphyon
2015-01-23 21:03 - 2015-01-23 21:03 - 04144094 _____ (No23) C:\Users\bfzn\Downloads\No23Recorder.exe
2015-01-22 00:03 - 2015-01-22 00:03 - 00000000 ____D () C:\Users\bfzn\AppData\Local\Apple
2015-01-19 21:12 - 2015-01-19 21:12 - 00101691 _____ () C:\Users\bfzn\Downloads\ComparePlugin.v1.5.6.2.bin.zip
2015-01-16 21:36 - 2015-01-16 21:36 - 00000000 ____D () C:\Users\bfzn\AppData\Local\ascendere_IT_Systeme
2015-01-16 20:50 - 2015-01-20 21:04 - 00000000 ____D () C:\Program Files (x86)\Isovar 2015
2015-01-16 20:50 - 2015-01-16 20:50 - 00001047 _____ () C:\Users\Public\Desktop\Isovar 2015.lnk
2015-01-16 20:50 - 2015-01-16 20:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Isovar 2015
2015-01-16 20:49 - 2015-01-16 20:49 - 07572386 _____ (ascendere IT-Systeme ) C:\Users\bfzn\Downloads\Isovar2015_Setup.exe
2015-01-16 20:44 - 2015-01-16 20:44 - 00000000 ____D () C:\Datensicherung_Beihilfe_V1_1
2015-01-16 20:36 - 2015-01-16 20:36 - 00000000 ____D () C:\Datensicherung_Beihilfe_V1_2
2015-01-16 20:25 - 2015-01-16 20:26 - 00000000 ____D () C:\ProgramData\HaNaSoftware
2015-01-16 20:18 - 2015-01-16 20:18 - 22386176 _____ (Microsoft Corporation) C:\Users\bfzn\Downloads\Install_Beihilfe_1.5.0.0.EXE
2015-01-13 23:25 - 2015-01-13 23:34 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\Mp3tag
2015-01-13 23:25 - 2015-01-13 23:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mp3tag
2015-01-13 23:25 - 2015-01-13 23:25 - 00000000 ____D () C:\Program Files (x86)\Mp3tag
2015-01-13 23:24 - 2015-01-13 23:24 - 02707360 _____ () C:\Users\bfzn\Downloads\mp3tagv266setup.exe
2015-01-13 21:42 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-13 21:42 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-13 21:42 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-01-13 21:42 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-01-13 21:42 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-01-13 21:42 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-01-13 21:42 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-01-13 21:42 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-01-13 21:42 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-01-13 21:42 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-13 21:42 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-13 21:42 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll
2015-01-13 21:42 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
2015-01-13 11:16 - 2015-01-13 11:17 - 00000000 ____D () C:\Users\bfzn\Documents\Sony PMB
2015-01-12 19:07 - 2015-01-12 19:07 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software
2015-01-12 19:07 - 2015-01-12 19:07 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software
2015-01-11 18:38 - 2015-01-11 18:38 - 00002103 _____ () C:\Users\Public\Desktop\PlayMemories Home-Hilfe.lnk
2015-01-11 18:38 - 2015-01-11 18:38 - 00001319 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMemories Home.lnk
2015-01-11 18:38 - 2015-01-11 18:38 - 00001307 _____ () C:\Users\Public\Desktop\PlayMemories Home.lnk
2015-01-11 18:38 - 2015-01-11 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMemories Home
2015-01-11 18:34 - 2015-01-11 18:34 - 00000394 _____ () C:\windows\DirectX.log
2015-01-11 18:34 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\windows\system32\d3dx9_35.dll
2015-01-11 18:34 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx9_35.dll
2015-01-11 18:34 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\windows\system32\d3dx9_30.dll
2015-01-11 18:34 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx9_30.dll
2015-01-10 12:23 - 2015-01-10 12:23 - 00000000 ____D () C:\Users\bfzn\Documents\ArcSoft
2015-01-10 12:22 - 2015-01-10 12:23 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\ArcSoft
2015-01-09 05:35 - 2015-01-09 05:35 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2015-01-08 00:39 - 2015-01-08 00:43 - 00000000 ____D () C:\Program Files (x86)\SonyEditor
2015-01-08 00:39 - 2015-01-08 00:39 - 00001035 _____ () C:\Users\bfzn\Desktop\SonyEditor.lnk
2015-01-08 00:39 - 2015-01-08 00:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SonyEditor
2015-01-05 19:02 - 2015-01-05 19:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung YH-925
2015-01-05 19:00 - 2015-01-05 19:01 - 00000000 ____D () C:\Users\bfzn\Downloads\neu
2015-01-05 18:55 - 2015-01-05 18:57 - 08808960 _____ () C:\Users\bfzn\Downloads\20051010100207250_YH-925_Utility_Program.exe
2015-01-05 18:53 - 2015-01-05 19:02 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-01-05 18:53 - 2015-01-05 18:53 - 00001133 _____ () C:\Users\bfzn\Desktop\Multimedia Studio.lnk
2015-01-05 18:53 - 2015-01-05 18:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-01-05 18:51 - 2015-01-05 18:53 - 13437996 _____ (Samsung ) C:\Users\bfzn\Downloads\20050617180246421_MMSSetup.exe
2015-01-05 18:49 - 2015-01-05 18:49 - 00009993 _____ () C:\Users\bfzn\Downloads\20041229084503828_YH-925_Driver.zip
2015-01-04 22:57 - 2015-01-04 22:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-01-04 22:56 - 2015-01-04 22:56 - 00000000 ____D () C:\windows\PCHEALTH
2015-01-04 22:53 - 2015-01-04 22:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
2015-01-04 22:51 - 2015-01-04 22:51 - 00000000 __RHD () C:\MSOCache
2015-01-04 22:35 - 2015-01-04 22:48 - 1025493776 _____ (Microsoft Corporation) C:\Users\bfzn\Downloads\MicrosoftInstaller.exe
2015-01-04 21:21 - 2015-01-04 21:22 - 00000000 ____D () C:\Program Files (x86)\MeineBeihilfe2009
2015-01-04 21:21 - 2015-01-04 21:21 - 00001832 _____ () C:\Users\Public\Desktop\MeineBeihilfe 2009.lnk
2015-01-04 21:21 - 2015-01-04 21:21 - 00000000 ____D () C:\Users\Public\Documents\MeineBeihilfe2009
2015-01-04 21:21 - 2015-01-04 21:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MeineBeihilfe2009
2015-01-04 21:11 - 2015-01-04 23:30 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-30 20:14 - 2009-07-14 05:45 - 00022480 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-30 20:14 - 2009-07-14 05:45 - 00022480 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-30 20:12 - 2014-11-29 21:18 - 00000000 ____D () C:\ProgramData\MFAData
2015-01-30 20:10 - 2014-11-29 22:00 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-30 20:08 - 2014-11-29 22:00 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-30 20:07 - 2010-12-07 13:05 - 00000000 ____D () C:\ProgramData\HPQLOG
2015-01-30 20:06 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-01-30 20:06 - 2009-07-14 05:51 - 00108318 _____ () C:\windows\setupact.log
2015-01-29 01:01 - 2014-11-29 20:50 - 01152129 _____ () C:\windows\WindowsUpdate.log
2015-01-29 00:25 - 2014-12-04 23:44 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-01-28 22:34 - 2014-11-29 21:32 - 00000000 ____D () C:\Users\bfzn\AppData\Local\PDFC
2015-01-28 22:20 - 2014-11-29 20:52 - 00000000 ____D () C:\Users\bfzadm
2015-01-28 21:21 - 2014-12-04 05:16 - 00024932 _____ () C:\windows\IE11_main.log
2015-01-28 05:46 - 2010-12-07 13:06 - 00699340 _____ () C:\windows\system32\perfh007.dat
2015-01-28 05:46 - 2010-12-07 13:06 - 00149448 _____ () C:\windows\system32\perfc007.dat
2015-01-28 05:46 - 2009-07-14 06:13 - 01619272 _____ () C:\windows\system32\PerfStringBackup.INI
2015-01-27 22:24 - 2014-11-29 21:43 - 00320710 _____ () C:\windows\PFRO.log
2015-01-26 21:08 - 2014-12-18 20:54 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\XnView
2015-01-26 19:07 - 2014-12-30 21:59 - 00000000 ____D () C:\Users\bfzn\AppData\Local\Microsoft Help
2015-01-25 21:25 - 2014-12-04 23:44 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 21:25 - 2014-12-04 23:44 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 14:19 - 2014-11-29 21:21 - 00000000 ____D () C:\ProgramData\AVG2015
2015-01-25 14:17 - 2014-11-29 21:21 - 00000981 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-01-25 14:17 - 2014-11-29 21:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-01-24 00:18 - 2010-12-07 13:05 - 00000000 ____D () C:\ProgramData\PDFC
2015-01-16 20:26 - 2014-11-30 01:15 - 00000000 ____D () C:\Users\bfzn\AppData\Local\CrashDumps
2015-01-11 18:38 - 2014-12-15 21:18 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\Sony Corporation
2015-01-11 18:34 - 2014-12-15 20:27 - 00000000 ____D () C:\Program Files (x86)\Sony
2015-01-11 18:31 - 2014-12-15 20:27 - 00002358 _____ () C:\Users\Public\Desktop\Image Data Converter Ver. 4.lnk
2015-01-10 12:23 - 2014-11-29 21:04 - 00000000 ___HD () C:\ProgramData\ArcSoft
2015-01-07 19:17 - 2014-12-10 21:12 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-05 19:02 - 2010-12-07 13:00 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-05 18:30 - 2014-11-29 21:32 - 00088016 _____ () C:\Users\bfzn\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-05 18:27 - 2009-07-14 05:45 - 00422224 _____ () C:\windows\system32\FNTCACHE.DAT
2015-01-04 22:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-01-04 22:53 - 2014-12-10 21:13 - 00000000 ____D () C:\Program Files\Microsoft Office
2015-01-04 22:53 - 2009-07-27 15:26 - 00000000 ____D () C:\windows\ShellNew
2015-01-04 21:12 - 2014-11-29 23:00 - 00000400 _____ () C:\windows\ODBC.INI
2015-01-04 21:07 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system
2015-01-04 20:56 - 2009-07-14 03:34 - 00000438 _____ () C:\windows\win.ini
2015-01-04 20:23 - 2014-11-29 23:33 - 00000000 ____D () C:\_Daten

Some content of TEMP:
====================
C:\Users\bfzadm\AppData\Local\Temp\CpqMC.dll
C:\Users\bfzadm\AppData\Local\Temp\HPQSi.exe
C:\Users\bfzadm\AppData\Local\Temp\ICReinstall_cdn_adsearchesfiles_com[1].exe
C:\Users\bfzadm\AppData\Local\Temp\MSNAED6.exe
C:\Users\bfzadm\AppData\Local\Temp\readSTILog.dll
C:\Users\bfzadm\AppData\Local\Temp\sagekey.dll
C:\Users\bfzadm\AppData\Local\Temp\SpOrder.dll
C:\Users\bfzadm\AppData\Local\Temp\_is5479.exe
C:\Users\bfzadm\AppData\Local\Temp\_is8CC4.exe
C:\Users\bfzadm\AppData\Local\Temp\_isA11.exe
C:\Users\bfzn\AppData\Local\Temp\Setup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
--- --- ---

--- --- ---


Wie komme ich an die Datei <Addition.txt>?


Alt 30.01.2015, 20:27   #6
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Meldung in Win7: Der Proxyserver reagiert nicht


Bitte FRST als Admin ausführen.


Schritt 1



Bitte starte FRST erneut, markiere auch die checkbox und drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.
__________________
--> Meldung in Win7: Der Proxyserver reagiert nicht

Alt 30.01.2015, 20:50   #7
BerndFranzen
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Meldung in Win7: Der Proxyserver reagiert nicht


Jetzt als Admin gestartet.
Zuerst FRST.txt

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015
Ran by bfzadm (administrator) on SEVENUP on 30-01-2015 20:46:10
Running from C:\Users\bfzadm\Downloads
Loaded Profiles: bfzadm & bfzn (Available profiles: bfzadm & bfzn)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Vosteran)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\stacsv64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Hewlett-Packard) C:\Windows\System32\hpservice.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(CartCrunch Israel Ltd.) C:\ProgramData\SecurityUtility\ColorMedia.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP QuickLook\32-bit\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(XTab system) C:\Program Files (x86)\XTab\ProtectService.exe
() C:\Program Files (x86)\WIntEnhance\WIntEnhance Internet Enhancer\InternetEnhancerService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
() C:\Users\bfzadm\AppData\Local\ConvertAd\CASrv.exe
() C:\Users\bfzadm\AppData\Roaming\SoftwareUpdater\SUsrv.exe
() C:\Users\bfzadm\AppData\Roaming\VOPackage\VOsrv.exe
(ArcSoft, Inc.) C:\Windows\system\uArcCapture.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(McAfee, Inc.) C:\Program Files\Hewlett-Packard\Drive Encryption\SbHpAuthenticatorService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIGAE.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Users\bfzadm\AppData\Local\ConvertAd\ConvertAd.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Program Files (x86)\WIntEnhance\WIntEnhance Internet Enhancer\InternetEnhancer.exe
(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
() C:\Users\bfzadm\AppData\Local\Vosteran\Application\vosteran.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
() C:\Users\bfzadm\AppData\Local\Vosteran\Application\vosteran.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
() C:\Users\bfzadm\AppData\Local\Vosteran\Application\vosteran.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
() C:\Users\bfzadm\AppData\Roaming\SoftwareUpdater\SoftwareUpdater.exe
() C:\Users\bfzadm\AppData\Roaming\SoftwareUpdater\UpdateNotifier.exe
() C:\Users\bfzadm\AppData\Local\Vosteran\Application\vosteran.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [HPPowerAssistant] => C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1691192 2010-06-19] (Hewlett-Packard Company)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-03-17] (IDT, Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-06-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-03-01] (Hewlett-Packard Company)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-04] (Intel Corporation)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [563736 2009-10-23] (PDF Complete Inc)
HKLM-x32\...\Run: [File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11265536 2009-12-12] (Hewlett-Packard)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DTRun] => c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [518656 2009-11-18] (ArcSoft Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [600936 2009-06-29] (Symantec Corporation)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3674576 2015-01-06] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [724576 2012-08-20] (Sony Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKU\S-1-5-21-2226251454-2989245828-1209764460-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-2226251454-2989245828-1209764460-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company)
HKU\S-1-5-21-2226251454-2989245828-1209764460-1001\...\Run: [GoogleChromeAutoLaunch_3D9F20947AAE5834E29A4A72DBC6161A] => C:\Users\bfzadm\AppData\Local\Vosteran\Application\vosteran.exe [1014272 2014-11-06] ()
HKU\S-1-5-21-2226251454-2989245828-1209764460-1004\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company)
HKU\S-1-5-21-2226251454-2989245828-1209764460-1004\...\Run: [Epson Stylus SX525WD(Netzwerk)] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGAE.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [301568 2014-12-02] (Microsoft Corporation)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\bfzadm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\134E09AA1.lnk
ShortcutTarget: 134E09AA1.lnk -> C:\PROGRA~3\1AA90E431.cpp (No File)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52515;https=127.0.0.1:52515
ProxyEnable: [S-1-5-21-2226251454-2989245828-1209764460-1001] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-2226251454-2989245828-1209764460-1001] => http=127.0.0.1:52515;https=127.0.0.1:52515
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
HKU\S-1-5-21-2226251454-2989245828-1209764460-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/de-de/?ocid=U218DHP&pc=U218
HKU\S-1-5-21-2226251454-2989245828-1209764460-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
HKU\S-1-5-21-2226251454-2989245828-1209764460-1001\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/1me10IE11DEDE/WOL_WCP
HKU\S-1-5-21-2226251454-2989245828-1209764460-1004\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKU\S-1-5-21-2226251454-2989245828-1209764460-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
SearchScopes: HKLM -> {AA5CC064-C92C-4050-82FD-3CA90F36F4FF} URL = hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ir_14_48_ie&cd=2XzuyEtN2Y1L1Qzu0EtDtB0AzztB0A0DyByCyEtD0FtAyC0BtN0D0Tzu0StCtDyCtAtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1BtN1L1G1B1V1N2Y1L1Qzu2StC0C0FyE0FyD0EyDtGyByDyB0DtGyD0F0C0EtGzy0CyE0BtGyC0C0A0AyBzyzy0AyD0D0Czz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtD0AyC0E0CtDtDtG0ByBzytCtGyE0D0BtBtGzyzzzyzztGtByC0Azz0D0CtCyByB0AyByC2Q&cr=1746014680&ir=
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
SearchScopes: HKLM-x32 -> {AA5CC064-C92C-4050-82FD-3CA90F36F4FF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2226251454-2989245828-1209764460-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://istart.webssearches.com/web/?utm_source=b&utm_medium=cvs2&utm_campaign=install_ie&utm_content=ds&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&ts=1422389600&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2226251454-2989245828-1209764460-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?utm_source=b&utm_medium=cvs2&utm_campaign=install_ie&utm_content=ds&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&ts=1422389600&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2226251454-2989245828-1209764460-1001 -> {AA5CC064-C92C-4050-82FD-3CA90F36F4FF} URL = hxxp://istart.webssearches.com/web/?utm_source=b&utm_medium=cvs2&utm_campaign=install_ie&utm_content=ds&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&ts=1422389600&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2226251454-2989245828-1209764460-1001 -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = hxxp://www.bing.com/search?FORM=U218DF&PC=U218&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2226251454-2989245828-1209764460-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://istart.webssearches.com/web/?utm_source=b&utm_medium=cvs2&utm_campaign=install_ie&utm_content=ds&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&ts=1422389600&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2226251454-2989245828-1209764460-1004 -> DefaultScope {AA5CC064-C92C-4050-82FD-3CA90F36F4FF} URL = 
SearchScopes: HKU\S-1-5-21-2226251454-2989245828-1209764460-1004 -> {AF0C3425-2B00-44B5-A39D-C644774ADC84} URL = https://www.google.com/search?q={searchTerms}
BHO: HP ProtectTools Security Manager Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\XTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: HP ProtectTools Security Manager Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-2226251454-2989245828-1209764460-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-2226251454-2989245828-1209764460-1004 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\windows\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)
Winsock: Catalog9 02 C:\windows\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)
Winsock: Catalog9 03 C:\windows\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)
Winsock: Catalog9 04 C:\windows\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)
Winsock: Catalog9 16 C:\windows\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)
Winsock: Catalog9-x64 01 C:\windows\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)
Winsock: Catalog9-x64 02 C:\windows\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)
Winsock: Catalog9-x64 03 C:\windows\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)
Winsock: Catalog9-x64 04 C:\windows\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)
Winsock: Catalog9-x64 16 C:\windows\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2010-12-07]

Chrome: 
=======
CHR Profile: C:\Users\bfzadm\AppData\Local\Google\Chrome\User Data\Default
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://istart.webssearches.com/?type=sc&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-17] (Adobe Systems Incorporated)
R2 AESTFilters; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3440080 2015-01-06] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [309232 2015-01-06] (AVG Technologies CZ, s.r.o.)
R2 ColorMedia; C:\ProgramData\SecurityUtility\ColorMedia.exe [1844232 2015-01-27] (CartCrunch Israel Ltd.) [File not signed]
R3 DEBridge; c:\Program Files\Hewlett-Packard\Drive Encryption\SbHpAuthenticatorService.exe [704512 2009-12-16] (McAfee, Inc.) [File not signed]
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [462088 2009-11-25] (DigitalPersona, Inc.)
R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed]
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [362040 2009-11-17] (Hewlett-Packard Ltd)
R2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [121344 2010-07-01] (Hewlett-Packard Company) [File not signed]
R2 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2009-11-19] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP QuickLook\32-bit\HPDayStarterService.exe [90112 2010-05-10] (Hewlett-Packard Company) [File not signed]
R2 HpFkCryptService; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2009-12-16] (McAfee, Inc.)
R2 HPFSService; C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [297984 2009-12-12] (Hewlett-Packard) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [264248 2010-03-01] (Hewlett-Packard Company)
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158896 2015-01-16] (XTab system)
R2 Internet Enhancer Service; C:\Program Files (x86)\WIntEnhance\WIntEnhance Internet Enhancer\InternetEnhancerService.exe [463872 2015-01-22] () [File not signed]
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-06-17] (Hewlett-Packard Company) [File not signed]
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [635416 2009-10-23] (PDF Complete Inc)
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474208 2012-08-20] (Sony Corporation)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] ()
R2 serverca; C:\Users\bfzadm\AppData\Local\ConvertAd\CASrv.exe [93696 2015-01-27] () [File not signed]
R2 serversu; C:\Users\bfzadm\AppData\Roaming\SoftwareUpdater\SUsrv.exe [120832 2015-01-27] () [File not signed]
R2 servervo; C:\Users\bfzadm\AppData\Roaming\VOPackage\VOsrv.exe [154112 2015-01-27] () [File not signed] <==== ATTENTION
R2 STacSV; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe [244736 2010-03-17] (IDT, Inc.)
R2 uArcCapture; C:\windows\system\uArcCapture.exe [506472 2009-12-04] (ArcSoft, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32640 2009-12-04] (ArcSoft, Inc.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [40760 2009-10-21] (Hewlett-Packard Development Company L.P.)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
R1 RsvLock; C:\Windows\System32\Drivers\RsvLock.sys [58184 2009-12-16] (McAfee, Inc.)
R1 RsvLock; C:\Windows\SysWow64\Drivers\RsvLock.sys [40088 2009-12-16] (McAfee, Inc.)
R0 SafeBoot; C:\Windows\System32\Drivers\SafeBoot.sys [56648 2009-12-16] ()
R0 SafeBoot; C:\Windows\SysWow64\Drivers\SafeBoot.sys [110520 2009-12-16] (McAfee, Inc.)
R0 SbAlg; C:\Windows\System32\Drivers\SbAlg.sys [60160 2009-06-04] (McAfee, Inc.)
R0 SbAlg; C:\Windows\SysWow64\Drivers\SbAlg.sys [51800 2009-12-16] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\System32\Drivers\SbFsLock.sys [15688 2009-12-16] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\SysWow64\Drivers\SbFsLock.sys [13256 2009-12-16] (McAfee, Inc.)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1803904 2010-10-13] ()

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-30 20:44 - 2015-01-30 20:46 - 00031609 _____ () C:\Users\bfzadm\Downloads\FRST.txt
2015-01-30 20:43 - 2015-01-30 20:44 - 02130432 _____ (Farbar) C:\Users\bfzadm\Downloads\FRST64.exe
2015-01-28 23:02 - 2015-01-28 23:03 - 00020928 _____ () C:\Users\bfzn\Desktop\Result.txt
2015-01-28 22:32 - 2015-01-28 22:32 - 00000000 ____D () C:\Users\bfzadm\AppData\Local\CrashDumps
2015-01-28 22:22 - 2015-01-30 20:46 - 00000000 ____D () C:\FRST
2015-01-28 22:20 - 2015-01-28 22:20 - 00000474 _____ () C:\Users\bfzn\Desktop\defogger_disable.log
2015-01-28 22:20 - 2015-01-28 22:20 - 00000000 _____ () C:\Users\bfzadm\defogger_reenable
2015-01-28 21:21 - 2015-01-28 21:21 - 00000000 ___HD () C:\windows\msdownld.tmp
2015-01-28 21:20 - 2015-01-28 21:20 - 65495720 _____ (Microsoft Corporation) C:\Users\bfzadm\Downloads\EIE11_DE-DE_WOL_WIN764.EXE
2015-01-28 19:19 - 2015-01-28 19:19 - 00000000 ____D () C:\Users\bfzadm\AppData\Roaming\Apple Computer
2015-01-27 21:39 - 2015-01-27 21:39 - 00002607 _____ () C:\Users\Public\Desktop\HNK für Excel.lnk
2015-01-27 21:39 - 2015-01-27 21:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Heiz- und Nebenkosten
2015-01-27 21:39 - 2015-01-27 21:39 - 00000000 ____D () C:\Program Files (x86)\KV Software
2015-01-27 21:19 - 2015-01-27 21:19 - 00000000 __SHD () C:\Users\bfzadm\AppData\Local\EmieUserList
2015-01-27 21:19 - 2015-01-27 21:19 - 00000000 __SHD () C:\Users\bfzadm\AppData\Local\EmieSiteList
2015-01-27 21:19 - 2015-01-27 21:19 - 00000000 __SHD () C:\Users\bfzadm\AppData\Local\EmieBrowserModeList
2015-01-27 21:18 - 2015-01-30 20:12 - 00000000 ____D () C:\Users\bfzadm\AppData\Roaming\SoftwareUpdater
2015-01-27 21:18 - 2015-01-27 21:18 - 00000000 ____D () C:\Users\bfzadm\AppData\Local\ConvertAd
2015-01-27 21:17 - 2015-01-27 21:17 - 00000000 ____D () C:\Temp
2015-01-27 21:16 - 2015-01-27 21:16 - 00000000 ____D () C:\Users\bfzadm\AppData\Roaming\dlg
2015-01-27 21:15 - 2015-01-27 21:20 - 00000000 ____D () C:\Users\bfzadm\AppData\Roaming\VOPackage
2015-01-27 21:15 - 2015-01-27 21:19 - 00000000 ____D () C:\Users\bfzadm\AppData\Local\wincheck
2015-01-27 21:15 - 2015-01-27 21:15 - 00000000 ____D () C:\Users\bfzadm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2015-01-27 21:14 - 2015-01-30 20:07 - 00005264 _____ () C:\windows\SysWOW64\ColorMedia.ini
2015-01-27 21:14 - 2015-01-30 20:07 - 00002864 _____ () C:\windows\SysWOW64\ColorMediaOff.ini
2015-01-27 21:14 - 2015-01-30 20:07 - 00002864 _____ () C:\windows\system32\ColorMediaOff.ini
2015-01-27 21:14 - 2015-01-30 20:07 - 00000000 ____D () C:\ProgramData\SecurityUtility
2015-01-27 21:14 - 2015-01-27 21:14 - 00000000 ____D () C:\ProgramData\SecurityUtilityData
2015-01-27 21:14 - 2015-01-27 21:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WIntEnhance
2015-01-27 21:14 - 2015-01-27 21:14 - 00000000 ____D () C:\Program Files (x86)\WIntEnhance
2015-01-27 21:14 - 2015-01-27 21:14 - 00000000 ____D () C:\Program Files (x86)\Wajam
2015-01-27 21:14 - 2015-01-27 17:31 - 00344440 _____ (CartCrunch Israel Ltd.) C:\windows\system32\ColorMedia64.dll
2015-01-27 21:14 - 2015-01-27 17:31 - 00301168 _____ (CartCrunch Israel Ltd.) C:\windows\SysWOW64\ColorMedia.dll
2015-01-27 21:13 - 2015-01-27 21:20 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2015-01-27 21:13 - 2015-01-27 21:13 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
2015-01-27 21:13 - 2015-01-27 21:13 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-01-26 18:33 - 2015-01-26 18:33 - 480951400 _____ () C:\windows\MEMORY.DMP
2015-01-26 18:33 - 2015-01-26 18:33 - 00344552 _____ () C:\windows\Minidump\012615-38563-01.dmp
2015-01-26 18:33 - 2015-01-26 18:33 - 00000000 ____D () C:\windows\Minidump
2015-01-23 21:04 - 2015-01-23 21:18 - 00000000 ____D () C:\Program Files (x86)\No23 Recorder
2015-01-23 21:04 - 2015-01-23 21:04 - 00001061 _____ () C:\Users\Public\Desktop\No23 Recorder.lnk
2015-01-23 21:04 - 2015-01-23 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\No23 Recorder
2015-01-23 21:04 - 2015-01-23 21:04 - 00000000 ____D () C:\ProgramData\Caphyon
2015-01-23 21:03 - 2015-01-23 21:03 - 04144094 _____ (No23) C:\Users\bfzn\Downloads\No23Recorder.exe
2015-01-22 00:03 - 2015-01-22 00:03 - 00000000 ____D () C:\Users\bfzn\AppData\Local\Apple
2015-01-19 21:12 - 2015-01-19 21:12 - 00101691 _____ () C:\Users\bfzn\Downloads\ComparePlugin.v1.5.6.2.bin.zip
2015-01-16 21:36 - 2015-01-16 21:36 - 00000000 ____D () C:\Users\bfzn\AppData\Local\ascendere_IT_Systeme
2015-01-16 20:50 - 2015-01-20 21:04 - 00000000 ____D () C:\Program Files (x86)\Isovar 2015
2015-01-16 20:50 - 2015-01-16 20:50 - 00001047 _____ () C:\Users\Public\Desktop\Isovar 2015.lnk
2015-01-16 20:50 - 2015-01-16 20:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Isovar 2015
2015-01-16 20:49 - 2015-01-16 20:49 - 07572386 _____ (ascendere IT-Systeme ) C:\Users\bfzn\Downloads\Isovar2015_Setup.exe
2015-01-16 20:44 - 2015-01-16 20:44 - 00000000 ____D () C:\Datensicherung_Beihilfe_V1_1
2015-01-16 20:36 - 2015-01-16 20:36 - 00000000 ____D () C:\Datensicherung_Beihilfe_V1_2
2015-01-16 20:25 - 2015-01-16 20:26 - 00000000 ____D () C:\ProgramData\HaNaSoftware
2015-01-16 20:18 - 2015-01-16 20:18 - 22386176 _____ (Microsoft Corporation) C:\Users\bfzn\Downloads\Install_Beihilfe_1.5.0.0.EXE
2015-01-13 23:25 - 2015-01-13 23:34 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\Mp3tag
2015-01-13 23:25 - 2015-01-13 23:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mp3tag
2015-01-13 23:25 - 2015-01-13 23:25 - 00000000 ____D () C:\Program Files (x86)\Mp3tag
2015-01-13 23:24 - 2015-01-13 23:24 - 02707360 _____ () C:\Users\bfzn\Downloads\mp3tagv266setup.exe
2015-01-13 21:42 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-13 21:42 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-13 21:42 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-01-13 21:42 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-01-13 21:42 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-01-13 21:42 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-01-13 21:42 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-01-13 21:42 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-01-13 21:42 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-01-13 21:42 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-13 21:42 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-13 21:42 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll
2015-01-13 21:42 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
2015-01-13 11:16 - 2015-01-13 11:17 - 00000000 ____D () C:\Users\bfzn\Documents\Sony PMB
2015-01-12 19:07 - 2015-01-12 19:07 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software
2015-01-12 19:07 - 2015-01-12 19:07 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software
2015-01-11 18:38 - 2015-01-11 18:38 - 00002103 _____ () C:\Users\Public\Desktop\PlayMemories Home-Hilfe.lnk
2015-01-11 18:38 - 2015-01-11 18:38 - 00001319 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMemories Home.lnk
2015-01-11 18:38 - 2015-01-11 18:38 - 00001307 _____ () C:\Users\Public\Desktop\PlayMemories Home.lnk
2015-01-11 18:38 - 2015-01-11 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMemories Home
2015-01-11 18:34 - 2015-01-11 18:34 - 00000394 _____ () C:\windows\DirectX.log
2015-01-11 18:34 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\windows\system32\d3dx9_35.dll
2015-01-11 18:34 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx9_35.dll
2015-01-11 18:34 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\windows\system32\d3dx9_30.dll
2015-01-11 18:34 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx9_30.dll
2015-01-10 12:23 - 2015-01-10 12:23 - 00000000 ____D () C:\Users\bfzn\Documents\ArcSoft
2015-01-10 12:22 - 2015-01-10 12:23 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\ArcSoft
2015-01-09 05:35 - 2015-01-09 05:35 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2015-01-08 00:39 - 2015-01-08 00:43 - 00000000 ____D () C:\Program Files (x86)\SonyEditor
2015-01-08 00:39 - 2015-01-08 00:39 - 00001035 _____ () C:\Users\bfzn\Desktop\SonyEditor.lnk
2015-01-08 00:39 - 2015-01-08 00:39 - 00001035 _____ () C:\Users\bfzadm\Desktop\SonyEditor.lnk
2015-01-08 00:39 - 2015-01-08 00:39 - 00000000 ____D () C:\Users\bfzadm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SonyEditor
2015-01-08 00:39 - 2015-01-08 00:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SonyEditor
2015-01-05 19:02 - 2015-01-05 19:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung YH-925
2015-01-05 19:00 - 2015-01-05 19:01 - 00000000 ____D () C:\Users\bfzn\Downloads\neu
2015-01-05 18:55 - 2015-01-05 18:57 - 08808960 _____ () C:\Users\bfzn\Downloads\20051010100207250_YH-925_Utility_Program.exe
2015-01-05 18:53 - 2015-01-05 19:02 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-01-05 18:53 - 2015-01-05 18:53 - 00001133 _____ () C:\Users\bfzn\Desktop\Multimedia Studio.lnk
2015-01-05 18:53 - 2015-01-05 18:53 - 00001133 _____ () C:\Users\bfzadm\Desktop\Multimedia Studio.lnk
2015-01-05 18:53 - 2015-01-05 18:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-01-05 18:51 - 2015-01-05 18:53 - 13437996 _____ (Samsung ) C:\Users\bfzn\Downloads\20050617180246421_MMSSetup.exe
2015-01-05 18:49 - 2015-01-05 18:49 - 00009993 _____ () C:\Users\bfzn\Downloads\20041229084503828_YH-925_Driver.zip
2015-01-04 22:57 - 2015-01-04 22:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-01-04 22:56 - 2015-01-04 22:56 - 00000000 ____D () C:\windows\PCHEALTH
2015-01-04 22:53 - 2015-01-04 22:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
2015-01-04 22:51 - 2015-01-04 22:51 - 00000000 __RHD () C:\MSOCache
2015-01-04 22:35 - 2015-01-04 22:48 - 1025493776 _____ (Microsoft Corporation) C:\Users\bfzn\Downloads\MicrosoftInstaller.exe
2015-01-04 21:21 - 2015-01-04 21:22 - 00000000 ____D () C:\Program Files (x86)\MeineBeihilfe2009
2015-01-04 21:21 - 2015-01-04 21:21 - 00001832 _____ () C:\Users\Public\Desktop\MeineBeihilfe 2009.lnk
2015-01-04 21:21 - 2015-01-04 21:21 - 00000000 ____D () C:\Users\Public\Documents\MeineBeihilfe2009
2015-01-04 21:21 - 2015-01-04 21:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MeineBeihilfe2009
2015-01-04 21:11 - 2015-01-04 23:30 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-30 20:41 - 2009-07-14 05:45 - 00022480 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-30 20:41 - 2009-07-14 05:45 - 00022480 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-30 20:39 - 2014-11-29 22:00 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-30 20:39 - 2014-11-29 20:50 - 01159719 _____ () C:\windows\WindowsUpdate.log
2015-01-30 20:34 - 2010-12-07 13:05 - 00000000 ____D () C:\ProgramData\HPQLOG
2015-01-30 20:34 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-01-30 20:34 - 2009-07-14 05:51 - 00108374 _____ () C:\windows\setupact.log
2015-01-30 20:25 - 2014-12-04 23:44 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-01-30 20:12 - 2014-11-29 21:18 - 00000000 ____D () C:\ProgramData\MFAData
2015-01-30 20:10 - 2014-11-29 22:00 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-28 22:34 - 2014-11-29 21:32 - 00000000 ____D () C:\Users\bfzn\AppData\Local\PDFC
2015-01-28 22:20 - 2014-11-29 20:52 - 00000000 ____D () C:\Users\bfzadm
2015-01-28 21:21 - 2014-12-04 05:16 - 00024932 _____ () C:\windows\IE11_main.log
2015-01-28 05:46 - 2010-12-07 13:06 - 00699340 _____ () C:\windows\system32\perfh007.dat
2015-01-28 05:46 - 2010-12-07 13:06 - 00149448 _____ () C:\windows\system32\perfc007.dat
2015-01-28 05:46 - 2009-07-14 06:13 - 01619272 _____ () C:\windows\system32\PerfStringBackup.INI
2015-01-27 22:24 - 2014-11-29 21:43 - 00320710 _____ () C:\windows\PFRO.log
2015-01-27 21:11 - 2014-12-09 00:47 - 00002475 _____ () C:\Users\bfzadm\Desktop\Google Chrome.lnk
2015-01-27 21:11 - 2014-11-29 21:12 - 00001661 _____ () C:\Users\bfzadm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-26 21:08 - 2014-12-18 20:54 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\XnView
2015-01-26 19:07 - 2014-12-30 21:59 - 00000000 ____D () C:\Users\bfzn\AppData\Local\Microsoft Help
2015-01-25 21:25 - 2014-12-04 23:44 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 21:25 - 2014-12-04 23:44 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 21:25 - 2014-12-04 23:44 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-01-25 14:19 - 2014-11-29 21:21 - 00000000 ____D () C:\ProgramData\AVG2015
2015-01-25 14:17 - 2014-11-29 21:21 - 00000981 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-01-25 14:17 - 2014-11-29 21:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-01-24 00:18 - 2010-12-07 13:05 - 00000000 ____D () C:\ProgramData\PDFC
2015-01-16 20:26 - 2014-11-30 01:15 - 00000000 ____D () C:\Users\bfzn\AppData\Local\CrashDumps
2015-01-11 18:38 - 2014-12-15 21:18 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\Sony Corporation
2015-01-11 18:34 - 2014-12-15 20:27 - 00000000 ____D () C:\Program Files (x86)\Sony
2015-01-11 18:31 - 2014-12-15 20:27 - 00002358 _____ () C:\Users\Public\Desktop\Image Data Converter Ver. 4.lnk
2015-01-10 12:23 - 2014-11-29 21:04 - 00000000 ___HD () C:\ProgramData\ArcSoft
2015-01-08 00:37 - 2014-11-29 21:10 - 00088016 _____ () C:\Users\bfzadm\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-07 19:17 - 2014-12-10 21:12 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-05 19:02 - 2010-12-07 13:00 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-05 18:30 - 2014-11-29 21:32 - 00088016 _____ () C:\Users\bfzn\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-05 18:27 - 2009-07-14 05:45 - 00422224 _____ () C:\windows\system32\FNTCACHE.DAT
2015-01-04 22:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-01-04 22:53 - 2014-12-10 21:13 - 00000000 ____D () C:\Program Files\Microsoft Office
2015-01-04 22:53 - 2009-07-27 15:26 - 00000000 ____D () C:\windows\ShellNew
2015-01-04 21:12 - 2014-11-29 23:00 - 00000400 _____ () C:\windows\ODBC.INI
2015-01-04 21:07 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system
2015-01-04 20:56 - 2009-07-14 03:34 - 00000438 _____ () C:\windows\win.ini
2015-01-04 20:23 - 2014-11-29 23:33 - 00000000 ____D () C:\_Daten

Some content of TEMP:
====================
C:\Users\bfzadm\AppData\Local\Temp\CpqMC.dll
C:\Users\bfzadm\AppData\Local\Temp\HPQSi.exe
C:\Users\bfzadm\AppData\Local\Temp\ICReinstall_cdn_adsearchesfiles_com[1].exe
C:\Users\bfzadm\AppData\Local\Temp\MSNAED6.exe
C:\Users\bfzadm\AppData\Local\Temp\readSTILog.dll
C:\Users\bfzadm\AppData\Local\Temp\sagekey.dll
C:\Users\bfzadm\AppData\Local\Temp\SpOrder.dll
C:\Users\bfzadm\AppData\Local\Temp\_is5479.exe
C:\Users\bfzadm\AppData\Local\Temp\_is8CC4.exe
C:\Users\bfzadm\AppData\Local\Temp\_isA11.exe
C:\Users\bfzn\AppData\Local\Temp\Setup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-24 00:55

==================== End Of Log ============================
--- --- ---

--- --- ---


und ADDITION.txt
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-01-2015
Ran by bfzadm at 2015-01-30 20:46:52
Running from C:\Users\bfzadm\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Photoshop Elements 11 (HKLM-x32\...\Adobe Photoshop Elements 11) (Version: 11.0 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5.7 64-bit (HKLM\...\{1B77B02E-17E4-4B6D-B8A1-74B29AF3D8DD}) (Version: 5.7.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft TotalMedia (HKLM-x32\...\ArcSoft TotalMedia) (Version: 1.0.23.26 - ArcSoft)
ArcSoft TotalMedia (x32 Version: 1.0.43.25 - ArcSoft) Hidden
ArcSoft Webcam Sharing Manager (HKLM-x32\...\{190A7D93-3823-439C-91B9-ADCE3EC2A6A2}) (Version: 1.0.0.26 - ArcSoft)
ATI Catalyst Install Manager (HKLM\...\{E534C3AC-6D49-4EAC-8993-C1F0FF545B67}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
Avery Wizard 5.0 (HKLM-x32\...\{FC3B3A5D-7058-4627-9F1E-F95CC38B6054}) (Version: 5.0.5 - Avery)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5646 - AVG Technologies)
AVG 2015 (Version: 15.0.4273 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5646 - AVG Technologies) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 2070 Bluetooth 3.0 (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.5600 - Broadcom Corporation)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.350.6 - Broadcom Corporation)
ccc-core-static (x32 Version: 2010.0805.358.5180 - ATI) Hidden
CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.75.0.2014 - Georgy Berdyshev)
ConvertAd (HKLM-x32\...\ConvertAd) (Version: 1.0.0.0 - ConvertAd) <==== ATTENTION!
Corel Home Office - CS Templates (x32 Version: 5.6 - 公司名称) Hidden
Corel Home Office - CT Templates (x32 Version: 5.6 - 您的公司名稱) Hidden
Corel Home Office - IPM (x32 Version: 5.6 - Corel Corporation) Hidden
Corel Home Office - JP Templates (x32 Version: 5.6 - 会社名) Hidden
Corel Home Office - KR Templates (x32 Version: 5.6 - 회사명) Hidden
Corel Home Office - Launcher (x32 Version: 5.6 - Corel Corporation) Hidden
Corel Home Office - Templates RU (x32 Version: 5.6 - Название организации) Hidden
Corel Home Office - Templates1 (x32 Version: 5.6 - Your Company Name) Hidden
Corel Home Office (HKLM-x32\...\_{36C95AD3-D330-4BAA-884A-9F3EFD15A5EA}) (Version: 5.0.85.588 - Corel Corporation)
Corel Home Office (x32 Version: 5.6 - Corel Corporation) Hidden
CUEcards 2000 (HKLM-x32\...\CUEcards 2000) (Version:  - Marcus Humann Software-Technik)
Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 5.0.1.5 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (HKLM-x32\...\Drive Encryption) (Version: 5.0.4.0 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (Version: 5.0.4.0 - Hewlett-Packard) Hidden
Elements 11 Organizer (x32 Version: 11.0 - Ihr Firmenname) Hidden
Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
Epson Event Manager (HKLM-x32\...\{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}) (Version: 2.40.0001 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON SX525WD Series Handbuch (HKLM-x32\...\EPSON SX525WD Series Manual) (Version:  - )
EPSON SX525WD Series Netzwerk-Handbuch (HKLM-x32\...\EPSON SX525WD Series Network Guide) (Version:  - )
EPSON SX525WD Series Printer Uninstall (HKLM\...\EPSON SX525WD Series) (Version:  - SEIKO EPSON Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
EpsonNet Setup 3.3 (HKLM-x32\...\{C9D8A041-2963-4B31-8FFC-1500F3DB9293}) (Version: 3.3a - SEIKO EPSON CORPORATION)
Face Recognition for HP ProtectTools (HKLM\...\{E793990C-90BE-4B69-AC29-BF5E8FD4ED54}) (Version: 2.02.4007 - Hewlett-Packard)
File Sanitizer For HP ProtectTools (HKLM-x32\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 5.0.1.2 - Hewlett-Packard)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Heizkosten (HKLM-x32\...\{373F123D-878C-4B89-B2D4-218C29273B98}) (Version: 6.5.0 - KV Software)
HP 3D DriveGuard (HKLM\...\{67C090D6-109A-47D7-8DED-4160C4D96F32}) (Version: 4.0.4.1 - Hewlett-Packard)
HP Documentation (HKLM-x32\...\{D21160A2-8B5F-409C-99C8-03582F5324B7}) (Version: 1.7.0.0 - Hewlett-Packard)
HP ESU for Microsoft Windows 7 (HKLM-x32\...\{D9989A13-B173-4048-B8A5-93C204DCB1B3}) (Version: 1.1.6.1 - Hewlett-Packard Company)
HP HotKey Support (HKLM\...\{4BBA5224-C5B1-4B8C-AAA4-68DA6654B9C1}) (Version: 3.5.15.1 - Hewlett-Packard Company)
HP Power Assistant (HKLM\...\{32C278B2-BC1F-4018-8FB4-2012A40D9FC1}) (Version: 1.0.9.0 - Hewlett-Packard Company)
HP Power Data (HKLM\...\{F2177395-FD90-44B0-AFB8-2E0566855E5C}) (Version: 1.0.31.182 - Hewlett-Packard)
HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 5.03.637 - Hewlett-Packard)
HP QuickLook (HKLM\...\{E6BEE2A9-04CF-42FF-B95B-BB70FAD2DC3E}) (Version: 3.3.1.2 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{7861911B-4270-498A-8F7A-FCF0570F487D}) (Version: 1.0.1.63 - DeviceVM, Inc.)
HP Setup (HKLM-x32\...\{E7C34ED4-BBB6-4C57-9FBD-B29CA5878051}) (Version: 8.5.4371.3505 - Hewlett-Packard Company)
HP SoftPaq Download Manager (HKLM-x32\...\{2DA697D7-FED3-4DE2-A174-92A2A12F9688}) (Version: 3.0.5.0 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{E05DB9F9-C8E7-45F2-BE9E-76D4C447CE9B}) (Version: 4.0.39.1 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\...\{04801E42-B1A6-4C52-9F3D-CADB5A050433}) (Version: 7.0.1.9 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{FC17E0A7-EAA9-4902-92F8-C83B9FD02246}) (Version: 5.0.14.2 - Hewlett-Packard Company)
HP Webcam Driver (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.50016.0 - Sonix)
HP Wireless Assistant (HKLM\...\{EC720706-3F19-4B7F-BDDD-E31D9B3921D2}) (Version: 4.0.6.0 - Hewlett-Packard)
HPAsset component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6275.0 - IDT)
Image Data Converter (HKLM-x32\...\{87998E4E-6D9C-411B-AAE9-B8523FFE357D}) (Version: 4.2.00.07270 - Sony Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.01.01.1007 - Intel Corporation)
Isovar 2015 Version 1.3.7.0 (HKLM-x32\...\{79E7FC4B-F866-48A0-85AA-0A44DFB3E208}_is1) (Version: 1.3.7.0 - ascendere IT-Systeme)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
LightScribe System Software (HKLM-x32\...\{82EF29B1-9B60-4142-A155-0599216DD053}) (Version: 1.18.6.1 - LightScribe)
MeineBeihilfe2009 (HKLM-x32\...\{AE926A81-E487-4D5D-9031-1EDB3242F943}) (Version: 10.54.0.0 - ComputerService)
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM-x32\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Access Runtime (German) 2007 (HKLM-x32\...\{90120000-001C-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mp3tag v2.66 (HKLM-x32\...\Mp3tag) (Version: v2.66 - Florian Heidenreich)
No23 Recorder (HKLM-x32\...\No23 Recorder) (Version: 2.1.0.3 - No23)
No23 Recorder (x32 Version: 2.1.0.3 - No23) Hidden
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.20.0 - Symantec)
paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
PDF Complete Special Edition (HKLM-x32\...\PDF Complete) (Version: 3.5.112 - PDF Complete, Inc)
PlayMemories Home (HKLM-x32\...\{8EB84CEC-6819-4E51-9E32-C756835637B0}) (Version: 6.3.03.08201 - Sony Corporation)
Pre-Boot Security for HP ProtectTools (Version: 5.0.7.1 - Hewlett-Packard) Hidden
Privacy Manager for HP ProtectTools (HKLM\...\{04255D34-6C6D-4F63-A218-EE8FD2D13AF0}) (Version: 5.10.796 - Hewlett-Packard)
PSE11 STI Installer (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 1.12.0011 - Realtek)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30109 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
Remote Desktop Access (VuuPC) (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - CMI Limited) <==== ATTENTION
Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version: 3.2.43 - Saal Digital Fotoservice GmbH)
Saal Design Software (x32 Version: 3.2.43 - Saal Digital Fotoservice GmbH) Hidden
Samsung Multimedia Studio 1.0 (HKLM-x32\...\Samsung Multimedia Studio_is1) (Version:  - Samsung)
SecurityUtility (HKLM-x32\...\SecurityUtility) (Version: 1.0.0.1919 - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Software Updater (HKLM-x32\...\SoftwareUpdater) (Version: 1.0.0.0 - Software Updater Ltd)
SonyEditor (remove only) (HKLM-x32\...\SonyEditor) (Version:  - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated)
Theft Recovery (HKLM-x32\...\InstallShield_{33C9F24B-1D92-4632-A915-81E3BB1D5D6B}) (Version: 5.1.0.18 - Hewlett-Packard)
Theft Recovery (x32 Version: 5.1.0.18 - Hewlett-Packard) Hidden
Validity Fingerprint Driver (HKLM\...\{516DA517-73A0-40F8-8CD9-E5ED4EC383E5}) (Version: 4.0.10.0 - Validity Sensors, Inc.)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Vosteran (HKU\S-1-5-21-2226251454-2989245828-1209764460-1001\...\Vosteran) (Version: 31.0.1650.23 - Vosteran) <==== ATTENTION!
Wajam (HKLM-x32\...\WIntEnhance) (Version: 2.23.2.5 (i2.6) - WIntEnhance) <==== ATTENTION
WDR RadioRecorder (HKLM-x32\...\Tobit Radio.fx Server 1) (Version:  - Tobit.Software)
webssearches uninstall (HKLM-x32\...\webssearches uninstall) (Version:  - webssearches) <==== ATTENTION
WinCheck (HKLM-x32\...\wincheck) (Version: 1.0.0.0 - WinCheck) <==== ATTENTION!
Windows 7 Default Setting (HKLM-x32\...\{5BF8E079-D6E2-4323-B794-75152371122A}) (Version: 1.0.1.6 - Hewlett-Packard Company)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinZip 14.5 (HKLM-x32\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}) (Version: 14.5.9095 - WinZip Computing, S.L. )
XnView 2.25 (HKLM-x32\...\XnView_is1) (Version: 2.25 - Gougelet Pierre-e)
YH-925 Driver & Utilities (HKLM-x32\...\{5C0BFEB4-4A1B-439C-91AC-9AED106DA213}) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

11-01-2015 18:27:51 Installiert Image Data Converter
11-01-2015 18:31:48 Installiert Image Data Converter
11-01-2015 18:33:58 DirectX wurde installiert
14-01-2015 17:47:58 Windows Update
16-01-2015 20:20:40 Beihilfe wird installiert
16-01-2015 23:43:56 Beihilfe wird entfernt
23-01-2015 21:04:10 No23 Recorder wird installiert
25-01-2015 14:15:40 Installed AVG 2015
27-01-2015 21:38:27 Heizkosten wird installiert

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {02F6F5CC-CAC2-4BE6-88EC-62F7099CE190} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-29] (Google Inc.)
Task: {417AB1ED-8EBA-42AF-845C-2C9132BDEABF} - System32\Tasks\AdobeAAMUpdater-1.0-SEVENUP-bfzn => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-06-16] (Adobe Systems Incorporated)
Task: {4753D026-8E22-4FD3-B113-1F6B025E4117} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-07-01] (Hewlett-Packard Company)
Task: {4D226E32-9183-470E-8397-4012691F9E0B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {B0B2142C-01B3-40B5-847F-103794439AD1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-29] (Google Inc.)
Task: {CB66F620-6DAE-4565-98C2-1420E5883D67} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-07-01] (Hewlett-Packard Company)
Task: {D12B18D2-4469-41B0-892E-287E678A2AAE} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {D25C78D7-9D75-402B-9EEA-8F4002FF99DC} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-02-11 22:50 - 2010-02-11 22:50 - 00746256 _____ () C:\windows\system32\SUPSDK.dll
2009-11-23 18:24 - 2009-11-23 18:24 - 01412608 ____R () C:\windows\system32\LIBEAY32.dll
2009-10-29 02:57 - 2009-10-29 02:57 - 00100864 _____ () c:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll
2015-01-22 15:53 - 2015-01-22 15:53 - 00463872 _____ () C:\Program Files (x86)\WIntEnhance\WIntEnhance Internet Enhancer\InternetEnhancerService.exe
2014-12-06 00:56 - 2011-11-18 14:51 - 03673944 _____ () C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
2015-01-27 21:18 - 2015-01-27 21:18 - 00093696 _____ () C:\Users\bfzadm\AppData\Local\ConvertAd\CASrv.exe
2015-01-27 21:18 - 2015-01-27 21:18 - 00120832 _____ () C:\Users\bfzadm\AppData\Roaming\SoftwareUpdater\SUsrv.exe
2015-01-27 21:15 - 2015-01-27 21:15 - 00154112 _____ () C:\Users\bfzadm\AppData\Roaming\VOPackage\VOsrv.exe
2010-06-19 01:25 - 2010-06-19 01:25 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HardwareAccess.dll
2010-06-19 01:25 - 2010-06-19 01:25 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HPCommon.XmlSerializers.dll
2010-06-19 01:25 - 2010-06-19 01:25 - 00055864 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\Graphs.dll
2010-06-08 23:55 - 2010-06-08 23:55 - 00173856 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2010-06-22 02:54 - 2010-06-22 02:54 - 00098304 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-08-05 12:57 - 2010-08-05 12:57 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2015-01-27 19:49 - 2015-01-27 19:49 - 01791488 _____ () C:\Users\bfzadm\AppData\Local\ConvertAd\ConvertAd.exe
2010-04-05 20:12 - 2010-04-05 20:12 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll
2010-04-05 20:11 - 2010-04-05 20:11 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2010-04-05 20:12 - 2010-04-05 20:12 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2015-01-22 15:53 - 2015-01-22 15:53 - 00077824 _____ () C:\Program Files (x86)\WIntEnhance\WIntEnhance Internet Enhancer\InternetEnhancer.exe
2014-11-29 21:40 - 2014-11-06 10:49 - 01014272 _____ () C:\Users\bfzadm\AppData\Local\Vosteran\Application\vosteran.exe
2015-01-27 19:55 - 2015-01-27 19:55 - 00067672 _____ () C:\Users\bfzadm\AppData\Roaming\SoftwareUpdater\SoftwareUpdater.exe
2015-01-27 21:18 - 2015-01-27 21:18 - 00448000 _____ () C:\Users\bfzadm\AppData\Roaming\SoftwareUpdater\UpdateNotifier.exe
2014-10-11 13:06 - 2014-10-11 13:06 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2009-06-17 20:40 - 2009-06-17 20:40 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2009-06-17 20:40 - 2009-06-17 20:40 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2009-06-17 20:40 - 2009-06-17 20:40 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2014-12-04 18:48 - 2014-12-04 18:48 - 00170496 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\3d576cbc4ffc5ad06fd61510c5d8f326\IsdiInterop.ni.dll
2010-12-07 13:00 - 2010-03-04 05:08 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-01-22 15:54 - 2015-01-22 15:54 - 00011776 _____ () C:\Program Files (x86)\WIntEnhance\WIntEnhance Internet Enhancer\ApiHandlr.dll
2014-11-29 21:40 - 2014-11-06 10:49 - 28005888 _____ () C:\Users\bfzadm\AppData\Local\Vosteran\Application\31.0.1650.23\chrome.dll
2014-11-29 21:40 - 2014-11-06 10:49 - 34445824 _____ () C:\Users\bfzadm\AppData\Local\Vosteran\Application\31.0.1650.23\chrome_child.dll
2014-11-29 21:40 - 2014-11-06 10:49 - 00695808 _____ () C:\Users\bfzadm\AppData\Local\Vosteran\Application\31.0.1650.23\libglesv2.dll
2014-11-29 21:40 - 2014-11-06 10:49 - 00093184 _____ () C:\Users\bfzadm\AppData\Local\Vosteran\Application\31.0.1650.23\libegl.dll
2014-11-29 21:40 - 2014-11-06 10:49 - 00394240 _____ () C:\Users\bfzadm\AppData\Local\Vosteran\Application\31.0.1650.23\ppGoogleNaClPluginChrome.dll
2014-11-29 21:40 - 2014-11-06 10:49 - 00788992 _____ () C:\Users\bfzadm\AppData\Local\Vosteran\Application\31.0.1650.23\ffmpegsumo.dll
2015-01-30 20:39 - 2015-01-30 20:39 - 00011264 _____ () C:\Users\bfzadm\AppData\Local\Temp\nsmAA43.tmp\System.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ColorMedia => ""="service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2226251454-2989245828-1209764460-500 - Administrator - Disabled)
bfzadm (S-1-5-21-2226251454-2989245828-1209764460-1001 - Administrator - Enabled) => C:\Users\bfzadm
bfzn (S-1-5-21-2226251454-2989245828-1209764460-1004 - Limited - Enabled) => C:\Users\bfzn
Gast (S-1-5-21-2226251454-2989245828-1209764460-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2226251454-2989245828-1209764460-1005 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/30/2015 08:38:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 804

Startzeit: 01d03cc3dafd7e5c

Endzeit: 31

Anwendungspfad: C:\windows\Explorer.EXE

Berichts-ID: 90073b1b-a8b7-11e4-aad6-e02a829ab71c

Error: (01/28/2015 10:32:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Name des fehlerhaften Moduls: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000011aa
ID des fehlerhaften Prozesses: 0x2aa8
Startzeit der fehlerhaften Anwendung: 0xGmer-19357.exe0
Pfad der fehlerhaften Anwendung: Gmer-19357.exe1
Pfad des fehlerhaften Moduls: Gmer-19357.exe2
Berichtskennung: Gmer-19357.exe3

Error: (01/28/2015 08:34:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2310001

Error: (01/28/2015 08:34:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2310001

Error: (01/28/2015 08:34:37 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (01/27/2015 10:02:11 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "1, 2, 0, 17" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (01/27/2015 00:52:45 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17496 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 19d4

Startzeit: 01d0398e6544cf3b

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (01/26/2015 11:56:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17496 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 24e4

Startzeit: 01d039ba738d5e01

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (01/25/2015 11:46:15 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "1, 2, 0, 17" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (01/24/2015 01:07:36 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "1, 2, 0, 17" des "version"-Attributs im assemblyIdentity-Element ist ungültig.


System errors:
=============
Error: (01/30/2015 08:33:51 PM) (Source: NetBT) (EventID: 4311) (User: )
Description: Es ist ein Initialisierungsfehler aufgetreten, da der Treiber nicht erstellt werden konnte.
Verwenden Sie die Zeichenfolge "643150131D65", um die Schnittstelle zu identifizieren, die nicht initialisiert werden
konnte. Sie stellt die MAC-Adresse der Schnittstelle mit dem Initialisierungsfehler oder die 
GUID (Globally Unique Interface Identifier) dar, wenn NetBT keine Zuordnung 
von der GUID zur MAC-Adresse herstellen konnte. Wenn weder die MAC-Adresse noch die GUID verfügbar 
waren, dann stellt die Zeichenfolge einen Clustergerätenamen dar.

Error: (01/30/2015 08:33:51 PM) (Source: NetBT) (EventID: 4311) (User: )
Description: Es ist ein Initialisierungsfehler aufgetreten, da der Treiber nicht erstellt werden konnte.
Verwenden Sie die Zeichenfolge "643150131D65", um die Schnittstelle zu identifizieren, die nicht initialisiert werden
konnte. Sie stellt die MAC-Adresse der Schnittstelle mit dem Initialisierungsfehler oder die 
GUID (Globally Unique Interface Identifier) dar, wenn NetBT keine Zuordnung 
von der GUID zur MAC-Adresse herstellen konnte. Wenn weder die MAC-Adresse noch die GUID verfügbar 
waren, dann stellt die Zeichenfolge einen Clustergerätenamen dar.

Error: (01/30/2015 08:07:46 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SecurityUtility Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/30/2015 08:06:29 PM) (Source: NetBT) (EventID: 4311) (User: )
Description: Es ist ein Initialisierungsfehler aufgetreten, da der Treiber nicht erstellt werden konnte.
Verwenden Sie die Zeichenfolge "643150131D65", um die Schnittstelle zu identifizieren, die nicht initialisiert werden
konnte. Sie stellt die MAC-Adresse der Schnittstelle mit dem Initialisierungsfehler oder die 
GUID (Globally Unique Interface Identifier) dar, wenn NetBT keine Zuordnung 
von der GUID zur MAC-Adresse herstellen konnte. Wenn weder die MAC-Adresse noch die GUID verfügbar 
waren, dann stellt die Zeichenfolge einen Clustergerätenamen dar.

Error: (01/30/2015 08:06:29 PM) (Source: NetBT) (EventID: 4311) (User: )
Description: Es ist ein Initialisierungsfehler aufgetreten, da der Treiber nicht erstellt werden konnte.
Verwenden Sie die Zeichenfolge "643150131D65", um die Schnittstelle zu identifizieren, die nicht initialisiert werden
konnte. Sie stellt die MAC-Adresse der Schnittstelle mit dem Initialisierungsfehler oder die 
GUID (Globally Unique Interface Identifier) dar, wenn NetBT keine Zuordnung 
von der GUID zur MAC-Adresse herstellen konnte. Wenn weder die MAC-Adresse noch die GUID verfügbar 
waren, dann stellt die Zeichenfolge einen Clustergerätenamen dar.

Error: (01/29/2015 01:01:09 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {51FA2736-5DEE-11D4-98E8-006008BF430C}

Error: (01/29/2015 00:59:43 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {51FA2736-5DEE-11D4-98E8-006008BF430C}

Error: (01/28/2015 10:58:39 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753635.

Error: (01/28/2015 10:58:38 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753635.

Error: (01/28/2015 10:58:37 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753635.


Microsoft Office Sessions:
=========================
Error: (01/30/2015 08:38:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.1.7601.1756780401d03cc3dafd7e5c31C:\windows\Explorer.EXE90073b1b-a8b7-11e4-aad6-e02a829ab71c

Error: (01/28/2015 10:32:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Gmer-19357.exe2.1.19357.052e7ea83Gmer-19357.exe2.1.19357.052e7ea83c0000005000011aa2aa801d03b41dc171e26C:\Users\bfzn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4QT7IUK6\Gmer-19357.exeC:\Users\bfzn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4QT7IUK6\Gmer-19357.exe22621dad-a735-11e4-8718-e02a829ab71c

Error: (01/28/2015 08:34:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2310001

Error: (01/28/2015 08:34:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2310001

Error: (01/28/2015 08:34:37 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (01/27/2015 10:02:11 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversion1, 2, 0, 17c:\Program Files (x86)\Arcsoft\TotalMedia Suite\TotalMedia Studio MV\CaptureModule.exe.Manifestc:\Program Files (x86)\Arcsoft\TotalMedia Suite\TotalMedia Studio MV\CaptureModule.exe.Manifest3

Error: (01/27/2015 00:52:45 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.1749619d401d0398e6544cf3b0C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (01/26/2015 11:56:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.1749624e401d039ba738d5e010C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (01/25/2015 11:46:15 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversion1, 2, 0, 17c:\Program Files (x86)\Arcsoft\TotalMedia Suite\TotalMedia Studio MV\CaptureModule.exe.Manifestc:\Program Files (x86)\Arcsoft\TotalMedia Suite\TotalMedia Studio MV\CaptureModule.exe.Manifest3

Error: (01/24/2015 01:07:36 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversion1, 2, 0, 17c:\Program Files (x86)\Arcsoft\TotalMedia Suite\TotalMedia Studio MV\CaptureModule.exe.Manifestc:\Program Files (x86)\Arcsoft\TotalMedia Suite\TotalMedia Studio MV\CaptureModule.exe.Manifest3


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5 CPU M 480 @ 2.67GHz
Percentage of memory in use: 54%
Total physical RAM: 3951.43 MB
Available physical RAM: 1791.41 MB
Total Pagefile: 7901.04 MB
Available Pagefile: 4317.58 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:448.47 GB) (Free:186.56 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.48 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: EC9CDE1C)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=448.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)

==================== End Of Log ============================

Alt 30.01.2015, 21:44   #8
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Meldung in Win7: Der Proxyserver reagiert nicht


Hi,

Schritt 1

Bitte deinstalliere folgende Programme:

ConvertAd
Remote Desktop Access
Vosteran
Wajam
webssearches uninstall
WinCheck

Versuche es bei Windows 7 zunächst über Systemsteuerung/Programme deinstallieren.

Sollte das nicht gehen, lade Dir bitte Revo Uninstallerhier herunter. Entpacke die zip-Datei auf den Desktop. Anleitung
  • Starte die Revouninstaller.exe
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den oben angegebenen Programmen und wähle sie einzeln aus.
    Klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

Wenn Du ein Programm nicht deinstallieren kannst, mach mit dem nächsten weiter.
Auch wenn am Ende noch Programme übrig geblieben sind, führe den nächsten Schritt aus:

Schritt 2
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 3

  • Download
  • Installiere das Programm in den vorgegebenen Pfad.
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
  • Unter Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
  • Klicke im Anschluss auf "Suchlauf", wähle den Bedrohungssuchlauf aus, aktualisiere die Datenbanken und klicke auf "Suchlauf jetzt starten".
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. (geht so...)
  • Poste mir den Inhalt der Logdatei (geht so...). Klicke dazu auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Klicke auf "In Zwischenablage kopieren" poste mir den Inhalt in Code-Tags als Antwort in den Thread.

Schritt 4



Bitte starte FRST erneut, markiere auch die checkbox und drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 31.01.2015, 13:23   #9
BerndFranzen
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

immer in kleinen Schritten...


Beim Deinstallieren habe ich "WAJAM" nicht gefunden

Hier jetzt zwei erstellte Logs von "AdwCleaner:

Code:
ATTFilter
# AdwCleaner v4.109 - Bericht erstellt am 31/01/2015 um 13:07:09
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-01-26.1 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : bfzadm - SEVENUP
# Gestartet von : C:\Users\bfzn\Desktop\AdwCleaner_4.109.exe
# Option : Suchen

***** [ Dienste ] *****

Dienst Gefunden : ColorMedia
Dienst Gefunden : IHProtect Service
Dienst Gefunden : serversu

***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_istart.webssearches.com_0.localstorage
Datei Gefunden : C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_istart.webssearches.com_0.localstorage-journal
Ordner Gefunden : C:\Program Files (x86)\Common Files\Tobit
Ordner Gefunden : C:\Program Files (x86)\Wajam
Ordner Gefunden : C:\Program Files (x86)\XTab
Ordner Gefunden : C:\ProgramData\IHProtectUpDate
Ordner Gefunden : C:\ProgramData\WindowsMangerProtect
Ordner Gefunden : C:\Users\bfzadm\AppData\Roaming\SoftwareUpdater
Ordner Gefunden : C:\Users\bfzadm\AppData\Roaming\Tobit
Ordner Gefunden : C:\Users\bfzadm\AppData\Roaming\webssearches
Ordner Gefunden : C:\Users\bfzn\AppData\Roaming\Tobit

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Daten Gefunden : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command [(Default)] - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
Schlüssel Gefunden : HKCU\Software\InstallCore
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AA5CC064-C92C-4050-82FD-3CA90F36F4FF}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gefunden : HKCU\Software\nuevos-programas.com
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : HKCU\Software\SecuredDownload
Schlüssel Gefunden : [x64] HKCU\Software\InstallCore
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AA5CC064-C92C-4050-82FD-3CA90F36F4FF}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gefunden : [x64] HKCU\Software\nuevos-programas.com
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\SecuredDownload
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Schlüssel Gefunden : HKLM\SOFTWARE\DeviceVM
Schlüssel Gefunden : HKLM\SOFTWARE\IHProtect
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdater
Schlüssel Gefunden : HKLM\SOFTWARE\SupDp
Schlüssel Gefunden : HKLM\SOFTWARE\SupTab
Schlüssel Gefunden : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gefunden : HKLM\SOFTWARE\webssearchesSoftware
Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\DeviceVM
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA5CC064-C92C-4050-82FD-3CA90F36F4FF}

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496

Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://istart.webssearches.com/web/?type=ds&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658&q={searchTerms}

-\\ Google Chrome v40.0.2214.93

[C:\Users\bfzadm\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gefunden [Homepage] : hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
[C:\Users\bfzadm\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gefunden [Startup_URLs] : hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
[C:\Users\bfzadm\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gefunden [Homepage] : hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
[C:\Users\bfzadm\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gefunden [Startup_URLs] : hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658

*************************

AdwCleaner[R0].txt - [9126 octets] - [31/01/2015 13:07:09]

########## EOF - \AdwCleaner\AdwCleaner[R0].txt - [9186 octets] ##########
und die zweite Datei:
Code:
ATTFilter
# AdwCleaner v4.109 - Bericht erstellt am 31/01/2015 um 13:10:35
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-01-26.1 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : bfzadm - SEVENUP
# Gestartet von : C:\Users\bfzn\Desktop\AdwCleaner_4.109.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : ColorMedia
Dienst Gelöscht : IHProtect Service
Dienst Gelöscht : serversu

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\ProgramData\IHProtectUpDate
Ordner Gelöscht : C:\Program Files (x86)\Wajam
Ordner Gelöscht : C:\Program Files (x86)\XTab
Ordner Gelöscht : C:\Program Files (x86)\Common Files\Tobit
Ordner Gelöscht : C:\Users\bfzadm\AppData\Roaming\SoftwareUpdater
Ordner Gelöscht : C:\Users\bfzadm\AppData\Roaming\Tobit
Ordner Gelöscht : C:\Users\bfzadm\AppData\Roaming\webssearches
Ordner Gelöscht : C:\Users\bfzn\AppData\Roaming\Tobit
Datei Gelöscht : C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_istart.webssearches.com_0.localstorage
Datei Gelöscht : C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_istart.webssearches.com_0.localstorage-journal

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AA5CC064-C92C-4050-82FD-3CA90F36F4FF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA5CC064-C92C-4050-82FD-3CA90F36F4FF}
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\nuevos-programas.com
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\SecuredDownload
Schlüssel Gelöscht : HKLM\SOFTWARE\DeviceVM
Schlüssel Gelöscht : HKLM\SOFTWARE\SupDp
Schlüssel Gelöscht : HKLM\SOFTWARE\SupTab
Schlüssel Gelöscht : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\webssearchesSoftware
Schlüssel Gelöscht : HKLM\SOFTWARE\IHProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdater
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DeviceVM

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Google Chrome v40.0.2214.93

[C:\Users\bfzadm\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Homepage] : hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
[C:\Users\bfzadm\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Startup_URLs] : hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
[C:\Users\bfzadm\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Homepage] : hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658
[C:\Users\bfzadm\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Startup_URLs] : hxxp://istart.webssearches.com/?type=hp&ts=1422389509&from=cvs2&uid=WDCXWD5000BEKT-60KA9T0_WD-WXL1AB06465864658

*************************

AdwCleaner[R0].txt - [9360 octets] - [31/01/2015 13:07:09]
AdwCleaner[S0].txt - [7320 octets] - [31/01/2015 13:10:35]

########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [7380 octets] ##########

Alt 31.01.2015, 13:40   #10
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Meldung in Win7: Der Proxyserver reagiert nicht


Zitat:
Zitat von BerndFranzen Beitrag anzeigen
Beim Deinstallieren habe ich "WAJAM" nicht gefunden
Code:
ATTFilter
Ordner Gelöscht : C:\Program Files (x86)\Wajam
Hat der Adwcleaner verspeist...

Gleich weiter mit den nächsten Schritten...
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 31.01.2015, 14:02   #11
BerndFranzen
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Meldung in Win7: Der Proxyserver reagiert nicht


Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 31.01.2015
Suchlauf-Zeit: 13:27:57
Logdatei: 
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.01.31.02
Rootkit Datenbank: v2015.01.14.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: bfzadm

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 393825
Verstrichene Zeit: 17 Min, 12 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 2
PUP.Optional.SupTab.A, HKU\S-1-5-21-2226251454-2989245828-1209764460-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [db76c433622743f3d2f5d726a35fb050], 
PUP.Optional.SupTab.A, HKU\S-1-5-21-2226251454-2989245828-1209764460-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [db76c433622743f3d2f5d726a35fb050], 

Registrierungswerte: 1
PUP.Optional.Vosteran, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\WSE_Vosteran\\, In Quarantäne, [59f8aa4d385171c51fddc93ec63f9b65]

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 6
PUP.Optional.Giga, C:\$Recycle.Bin\S-1-5-21-2226251454-2989245828-1209764460-1004\$RXL8ZLV.partial, In Quarantäne, [d081f8ff4c3d42f42c4370266d98a55b], 
PUP.Optional.Giga, C:\$Recycle.Bin\S-1-5-21-2226251454-2989245828-1209764460-1004\$ROQOIU0.partial, In Quarantäne, [53fe03f49ceddd59da958e08669f0ef2], 
PUP.Optional.WindowsProtectManger.A, C:\Users\bfzadm\AppData\Local\Temp\~dl87B\~dljyb\tmp\wpm_v20.0.0.1714.exe, In Quarantäne, [e8695b9c3a4f67cfc9fa2f377888cd33], 
PUP.Optional.XTab.A, C:\Users\bfzadm\AppData\Local\Temp\~dl87B\~dljyb\tmp\XTab_v4.0.exe, In Quarantäne, [c09191668900ed49aa0665a3f60c23dd], 
PUP.Optional.ColorMedia.A, C:\Windows\SysWOW64\ColorMedia.ini, In Quarantäne, [69e87384cbbe55e1cb069d655ca9ec14], 
PUP.Optional.ColorMedia.A, C:\Windows\SysWOW64\ColorMediaOff.ini, In Quarantäne, [1c35787fd3b601355a78ca38f114d927], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-01-2015
Ran by bfzn (ATTENTION: The logged in user is not administrator) on SEVENUP on 31-01-2015 13:59:10
Running from C:\Users\bfzn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4QT7IUK6
Loaded Profiles: bfzadm & bfzn (Available profiles: bfzadm & bfzn)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIGAE.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_16_0_0_296_ActiveX.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [HPPowerAssistant] => C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1691192 2010-06-19] (Hewlett-Packard Company)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-03-17] (IDT, Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-06-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-03-01] (Hewlett-Packard Company)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-04] (Intel Corporation)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [563736 2009-10-23] (PDF Complete Inc)
HKLM-x32\...\Run: [File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11265536 2009-12-12] (Hewlett-Packard)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DTRun] => c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [518656 2009-11-18] (ArcSoft Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [600936 2009-06-29] (Symantec Corporation)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3674576 2015-01-06] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [724576 2012-08-20] (Sony Corporation)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKU\S-1-5-21-2226251454-2989245828-1209764460-1004\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company)
HKU\S-1-5-21-2226251454-2989245828-1209764460-1004\...\Run: [Epson Stylus SX525WD(Netzwerk)] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGAE.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [301568 2014-12-02] (Microsoft Corporation)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52515;https=127.0.0.1:52515
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-2226251454-2989245828-1209764460-1004\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKU\S-1-5-21-2226251454-2989245828-1209764460-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
URLSearchHook: [S-1-5-21-2226251454-2989245828-1209764460-1001] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {AA5CC064-C92C-4050-82FD-3CA90F36F4FF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2226251454-2989245828-1209764460-1004 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2226251454-2989245828-1209764460-1004 -> {AF0C3425-2B00-44B5-A39D-C644774ADC84} URL = https://www.google.com/search?q={searchTerms}
BHO: HP ProtectTools Security Manager Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: HP ProtectTools Security Manager Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-2226251454-2989245828-1209764460-1004 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2010-12-07]

Chrome: 
=======
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Presentaciones de Google) - C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-28]
CHR Extension: (Google Docs) - C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-28]
CHR Extension: (Hojas de cálculo de Google) - C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-28]
CHR Extension: (Google Wallet) - C:\Users\bfzn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-29]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-17] (Adobe Systems Incorporated)
R2 AESTFilters; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3440080 2015-01-06] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [309232 2015-01-06] (AVG Technologies CZ, s.r.o.)
R3 DEBridge; c:\Program Files\Hewlett-Packard\Drive Encryption\SbHpAuthenticatorService.exe [704512 2009-12-16] (McAfee, Inc.) [File not signed]
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [462088 2009-11-25] (DigitalPersona, Inc.)
R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed]
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [362040 2009-11-17] (Hewlett-Packard Ltd)
R2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [121344 2010-07-01] (Hewlett-Packard Company) [File not signed]
R2 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2009-11-19] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP QuickLook\32-bit\HPDayStarterService.exe [90112 2010-05-10] (Hewlett-Packard Company) [File not signed]
R2 HpFkCryptService; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2009-12-16] (McAfee, Inc.)
R2 HPFSService; C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [297984 2009-12-12] (Hewlett-Packard) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [264248 2010-03-01] (Hewlett-Packard Company)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-06-17] (Hewlett-Packard Company) [File not signed]
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [635416 2009-10-23] (PDF Complete Inc)
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474208 2012-08-20] (Sony Corporation)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] ()
R2 STacSV; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe [244736 2010-03-17] (IDT, Inc.)
R2 uArcCapture; C:\windows\system\uArcCapture.exe [506472 2009-12-04] (ArcSoft, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32640 2009-12-04] (ArcSoft, Inc.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [40760 2009-10-21] (Hewlett-Packard Development Company L.P.)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [129752 2015-01-31] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
R1 RsvLock; C:\Windows\System32\Drivers\RsvLock.sys [58184 2009-12-16] (McAfee, Inc.)
R1 RsvLock; C:\Windows\SysWow64\Drivers\RsvLock.sys [40088 2009-12-16] (McAfee, Inc.)
R0 SafeBoot; C:\Windows\System32\Drivers\SafeBoot.sys [56648 2009-12-16] ()
R0 SafeBoot; C:\Windows\SysWow64\Drivers\SafeBoot.sys [110520 2009-12-16] (McAfee, Inc.)
R0 SbAlg; C:\Windows\System32\Drivers\SbAlg.sys [60160 2009-06-04] (McAfee, Inc.)
R0 SbAlg; C:\Windows\SysWow64\Drivers\SbAlg.sys [51800 2009-12-16] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\System32\Drivers\SbFsLock.sys [15688 2009-12-16] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\SysWow64\Drivers\SbFsLock.sys [13256 2009-12-16] (McAfee, Inc.)
S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1803904 2010-10-13] ()

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-31 13:26 - 2015-01-31 13:27 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-31 13:25 - 2015-01-31 13:25 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-31 13:25 - 2015-01-31 13:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-31 13:25 - 2015-01-31 13:25 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-31 13:25 - 2015-01-31 13:25 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-31 13:25 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-01-31 13:25 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-01-31 13:25 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-01-31 13:06 - 2015-01-31 13:06 - 02194432 _____ () C:\Users\bfzn\Desktop\AdwCleaner_4.109.exe
2015-01-31 13:02 - 2015-01-31 13:10 - 00000000 ____D () C:\AdwCleaner
2015-01-31 12:55 - 2015-01-31 12:55 - 00000000 ____D () C:\Users\bfzn\Desktop\RevoUninstallerPortable
2015-01-28 23:02 - 2015-01-28 23:03 - 00020928 _____ () C:\Users\bfzn\Desktop\Result.txt
2015-01-28 22:22 - 2015-01-31 13:59 - 00000000 ____D () C:\FRST
2015-01-28 22:20 - 2015-01-28 22:20 - 00000474 _____ () C:\Users\bfzn\Desktop\defogger_disable.log
2015-01-28 22:20 - 2015-01-28 22:20 - 00000000 _____ () C:\Users\bfzadm\defogger_reenable
2015-01-28 21:21 - 2015-01-28 21:21 - 00000000 ___HD () C:\windows\msdownld.tmp
2015-01-28 19:19 - 2015-01-28 19:19 - 00000000 ____D () C:\Users\bfzadm\AppData\Roaming\Apple Computer
2015-01-27 21:39 - 2015-01-27 21:39 - 00002607 _____ () C:\Users\Public\Desktop\HNK für Excel.lnk
2015-01-27 21:39 - 2015-01-27 21:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Heiz- und Nebenkosten
2015-01-27 21:39 - 2015-01-27 21:39 - 00000000 ____D () C:\Program Files (x86)\KV Software
2015-01-27 21:17 - 2015-01-27 21:17 - 00000000 ____D () C:\Temp
2015-01-27 21:16 - 2015-01-27 21:16 - 00000000 ____D () C:\Users\bfzadm\AppData\Roaming\dlg
2015-01-27 21:14 - 2015-01-30 20:07 - 00000000 ____D () C:\ProgramData\SecurityUtility
2015-01-27 21:14 - 2015-01-27 21:14 - 00000000 ____D () C:\ProgramData\SecurityUtilityData
2015-01-27 21:14 - 2015-01-27 17:31 - 00344440 _____ (CartCrunch Israel Ltd.) C:\windows\system32\ColorMedia64.dll
2015-01-27 21:14 - 2015-01-27 17:31 - 00301168 _____ (CartCrunch Israel Ltd.) C:\windows\SysWOW64\ColorMedia.dll
2015-01-26 18:33 - 2015-01-26 18:33 - 480951400 _____ () C:\windows\MEMORY.DMP
2015-01-26 18:33 - 2015-01-26 18:33 - 00000000 ____D () C:\windows\Minidump
2015-01-23 21:04 - 2015-01-23 21:18 - 00000000 ____D () C:\Program Files (x86)\No23 Recorder
2015-01-23 21:04 - 2015-01-23 21:04 - 00001061 _____ () C:\Users\Public\Desktop\No23 Recorder.lnk
2015-01-23 21:04 - 2015-01-23 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\No23 Recorder
2015-01-23 21:04 - 2015-01-23 21:04 - 00000000 ____D () C:\ProgramData\Caphyon
2015-01-23 21:03 - 2015-01-23 21:03 - 04144094 _____ (No23) C:\Users\bfzn\Downloads\No23Recorder.exe
2015-01-22 00:03 - 2015-01-22 00:03 - 00000000 ____D () C:\Users\bfzn\AppData\Local\Apple
2015-01-19 21:12 - 2015-01-19 21:12 - 00101691 _____ () C:\Users\bfzn\Downloads\ComparePlugin.v1.5.6.2.bin.zip
2015-01-16 21:36 - 2015-01-16 21:36 - 00000000 ____D () C:\Users\bfzn\AppData\Local\ascendere_IT_Systeme
2015-01-16 20:50 - 2015-01-20 21:04 - 00000000 ____D () C:\Program Files (x86)\Isovar 2015
2015-01-16 20:50 - 2015-01-16 20:50 - 00001047 _____ () C:\Users\Public\Desktop\Isovar 2015.lnk
2015-01-16 20:50 - 2015-01-16 20:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Isovar 2015
2015-01-16 20:49 - 2015-01-16 20:49 - 07572386 _____ (ascendere IT-Systeme ) C:\Users\bfzn\Downloads\Isovar2015_Setup.exe
2015-01-16 20:44 - 2015-01-16 20:44 - 00000000 ____D () C:\Datensicherung_Beihilfe_V1_1
2015-01-16 20:36 - 2015-01-16 20:36 - 00000000 ____D () C:\Datensicherung_Beihilfe_V1_2
2015-01-16 20:25 - 2015-01-16 20:26 - 00000000 ____D () C:\ProgramData\HaNaSoftware
2015-01-16 20:18 - 2015-01-16 20:18 - 22386176 _____ (Microsoft Corporation) C:\Users\bfzn\Downloads\Install_Beihilfe_1.5.0.0.EXE
2015-01-13 23:25 - 2015-01-13 23:34 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\Mp3tag
2015-01-13 23:25 - 2015-01-13 23:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mp3tag
2015-01-13 23:25 - 2015-01-13 23:25 - 00000000 ____D () C:\Program Files (x86)\Mp3tag
2015-01-13 23:24 - 2015-01-13 23:24 - 02707360 _____ () C:\Users\bfzn\Downloads\mp3tagv266setup.exe
2015-01-13 21:42 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-13 21:42 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-13 21:42 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-01-13 21:42 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-01-13 21:42 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-01-13 21:42 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-01-13 21:42 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-01-13 21:42 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-01-13 21:42 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-01-13 21:42 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-13 21:42 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-13 21:42 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll
2015-01-13 21:42 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
2015-01-13 11:16 - 2015-01-13 11:17 - 00000000 ____D () C:\Users\bfzn\Documents\Sony PMB
2015-01-12 19:07 - 2015-01-12 19:07 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software
2015-01-12 19:07 - 2015-01-12 19:07 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software
2015-01-11 18:38 - 2015-01-11 18:38 - 00002103 _____ () C:\Users\Public\Desktop\PlayMemories Home-Hilfe.lnk
2015-01-11 18:38 - 2015-01-11 18:38 - 00001319 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMemories Home.lnk
2015-01-11 18:38 - 2015-01-11 18:38 - 00001307 _____ () C:\Users\Public\Desktop\PlayMemories Home.lnk
2015-01-11 18:38 - 2015-01-11 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMemories Home
2015-01-11 18:34 - 2015-01-11 18:34 - 00000394 _____ () C:\windows\DirectX.log
2015-01-11 18:34 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\windows\system32\d3dx9_35.dll
2015-01-11 18:34 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx9_35.dll
2015-01-11 18:34 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\windows\system32\d3dx9_30.dll
2015-01-11 18:34 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx9_30.dll
2015-01-10 12:23 - 2015-01-10 12:23 - 00000000 ____D () C:\Users\bfzn\Documents\ArcSoft
2015-01-10 12:22 - 2015-01-10 12:23 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\ArcSoft
2015-01-09 05:35 - 2015-01-09 05:35 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2015-01-08 00:39 - 2015-01-08 00:43 - 00000000 ____D () C:\Program Files (x86)\SonyEditor
2015-01-08 00:39 - 2015-01-08 00:39 - 00001035 _____ () C:\Users\bfzn\Desktop\SonyEditor.lnk
2015-01-08 00:39 - 2015-01-08 00:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SonyEditor
2015-01-05 19:02 - 2015-01-05 19:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung YH-925
2015-01-05 19:00 - 2015-01-05 19:01 - 00000000 ____D () C:\Users\bfzn\Downloads\neu
2015-01-05 18:55 - 2015-01-05 18:57 - 08808960 _____ () C:\Users\bfzn\Downloads\20051010100207250_YH-925_Utility_Program.exe
2015-01-05 18:53 - 2015-01-05 19:02 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-01-05 18:53 - 2015-01-05 18:53 - 00001133 _____ () C:\Users\bfzn\Desktop\Multimedia Studio.lnk
2015-01-05 18:53 - 2015-01-05 18:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-01-05 18:51 - 2015-01-05 18:53 - 13437996 _____ (Samsung ) C:\Users\bfzn\Downloads\20050617180246421_MMSSetup.exe
2015-01-05 18:49 - 2015-01-05 18:49 - 00009993 _____ () C:\Users\bfzn\Downloads\20041229084503828_YH-925_Driver.zip
2015-01-04 22:57 - 2015-01-04 22:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-01-04 22:56 - 2015-01-04 22:56 - 00000000 ____D () C:\windows\PCHEALTH
2015-01-04 22:53 - 2015-01-04 22:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
2015-01-04 22:51 - 2015-01-04 22:51 - 00000000 __RHD () C:\MSOCache
2015-01-04 22:35 - 2015-01-04 22:48 - 1025493776 _____ (Microsoft Corporation) C:\Users\bfzn\Downloads\MicrosoftInstaller.exe
2015-01-04 21:21 - 2015-01-04 21:22 - 00000000 ____D () C:\Program Files (x86)\MeineBeihilfe2009
2015-01-04 21:21 - 2015-01-04 21:21 - 00001832 _____ () C:\Users\Public\Desktop\MeineBeihilfe 2009.lnk
2015-01-04 21:21 - 2015-01-04 21:21 - 00000000 ____D () C:\Users\Public\Documents\MeineBeihilfe2009
2015-01-04 21:21 - 2015-01-04 21:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MeineBeihilfe2009
2015-01-04 21:11 - 2015-01-04 23:30 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-31 13:59 - 2009-07-14 05:45 - 00022480 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-31 13:59 - 2009-07-14 05:45 - 00022480 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-31 13:56 - 2014-11-29 20:50 - 01193595 _____ () C:\windows\WindowsUpdate.log
2015-01-31 13:52 - 2014-11-29 22:00 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-31 13:51 - 2010-12-07 13:05 - 00000000 ____D () C:\ProgramData\HPQLOG
2015-01-31 13:51 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-01-31 13:51 - 2009-07-14 05:51 - 00108542 _____ () C:\windows\setupact.log
2015-01-31 13:50 - 2014-11-29 21:43 - 00324604 _____ () C:\windows\PFRO.log
2015-01-31 13:25 - 2014-12-04 23:44 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-01-31 13:10 - 2014-11-29 22:00 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-31 11:22 - 2014-11-29 21:18 - 00000000 ____D () C:\ProgramData\MFAData
2015-01-31 11:19 - 2010-12-07 13:05 - 00000000 ____D () C:\ProgramData\PDFC
2015-01-30 20:54 - 2010-12-07 13:06 - 00699340 _____ () C:\windows\system32\perfh007.dat
2015-01-30 20:54 - 2010-12-07 13:06 - 00149448 _____ () C:\windows\system32\perfc007.dat
2015-01-30 20:54 - 2009-07-14 06:13 - 01619272 _____ () C:\windows\system32\PerfStringBackup.INI
2015-01-28 22:34 - 2014-11-29 21:32 - 00000000 ____D () C:\Users\bfzn\AppData\Local\PDFC
2015-01-28 22:20 - 2014-11-29 20:52 - 00000000 ____D () C:\Users\bfzadm
2015-01-28 21:21 - 2014-12-04 05:16 - 00024932 _____ () C:\windows\IE11_main.log
2015-01-26 21:08 - 2014-12-18 20:54 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\XnView
2015-01-26 19:07 - 2014-12-30 21:59 - 00000000 ____D () C:\Users\bfzn\AppData\Local\Microsoft Help
2015-01-25 21:25 - 2014-12-04 23:44 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 21:25 - 2014-12-04 23:44 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 14:19 - 2014-11-29 21:21 - 00000000 ____D () C:\ProgramData\AVG2015
2015-01-25 14:17 - 2014-11-29 21:21 - 00000981 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-01-25 14:17 - 2014-11-29 21:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-01-16 20:26 - 2014-11-30 01:15 - 00000000 ____D () C:\Users\bfzn\AppData\Local\CrashDumps
2015-01-11 18:38 - 2014-12-15 21:18 - 00000000 ____D () C:\Users\bfzn\AppData\Roaming\Sony Corporation
2015-01-11 18:34 - 2014-12-15 20:27 - 00000000 ____D () C:\Program Files (x86)\Sony
2015-01-11 18:31 - 2014-12-15 20:27 - 00002358 _____ () C:\Users\Public\Desktop\Image Data Converter Ver. 4.lnk
2015-01-10 12:23 - 2014-11-29 21:04 - 00000000 ___HD () C:\ProgramData\ArcSoft
2015-01-07 19:17 - 2014-12-10 21:12 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-05 19:02 - 2010-12-07 13:00 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-05 18:30 - 2014-11-29 21:32 - 00088016 _____ () C:\Users\bfzn\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-05 18:27 - 2009-07-14 05:45 - 00422224 _____ () C:\windows\system32\FNTCACHE.DAT
2015-01-04 22:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-01-04 22:53 - 2014-12-10 21:13 - 00000000 ____D () C:\Program Files\Microsoft Office
2015-01-04 22:53 - 2009-07-27 15:26 - 00000000 ____D () C:\windows\ShellNew
2015-01-04 21:12 - 2014-11-29 23:00 - 00000400 _____ () C:\windows\ODBC.INI
2015-01-04 21:07 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system
2015-01-04 20:56 - 2009-07-14 03:34 - 00000438 _____ () C:\windows\win.ini
2015-01-04 20:23 - 2014-11-29 23:33 - 00000000 ____D () C:\_Daten

Some content of TEMP:
====================
C:\Users\bfzadm\AppData\Local\Temp\CpqMC.dll
C:\Users\bfzadm\AppData\Local\Temp\HPQSi.exe
C:\Users\bfzadm\AppData\Local\Temp\ICReinstall_cdn_adsearchesfiles_com[1].exe
C:\Users\bfzadm\AppData\Local\Temp\MSNAED6.exe
C:\Users\bfzadm\AppData\Local\Temp\Quarantine.exe
C:\Users\bfzadm\AppData\Local\Temp\readSTILog.dll
C:\Users\bfzadm\AppData\Local\Temp\sagekey.dll
C:\Users\bfzadm\AppData\Local\Temp\SpOrder.dll
C:\Users\bfzadm\AppData\Local\Temp\sqlite3.dll
C:\Users\bfzadm\AppData\Local\Temp\_is5479.exe
C:\Users\bfzadm\AppData\Local\Temp\_is8CC4.exe
C:\Users\bfzadm\AppData\Local\Temp\_isA11.exe
C:\Users\bfzn\AppData\Local\Temp\Setup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-01-2015
Ran by bfzn at 2015-01-31 13:59:52
Running from C:\Users\bfzn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4QT7IUK6
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Photoshop Elements 11 (HKLM-x32\...\Adobe Photoshop Elements 11) (Version: 11.0 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5.7 64-bit (HKLM\...\{1B77B02E-17E4-4B6D-B8A1-74B29AF3D8DD}) (Version: 5.7.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft TotalMedia (HKLM-x32\...\ArcSoft TotalMedia) (Version: 1.0.23.26 - ArcSoft)
ArcSoft TotalMedia (x32 Version: 1.0.43.25 - ArcSoft) Hidden
ArcSoft Webcam Sharing Manager (HKLM-x32\...\{190A7D93-3823-439C-91B9-ADCE3EC2A6A2}) (Version: 1.0.0.26 - ArcSoft)
ATI Catalyst Install Manager (HKLM\...\{E534C3AC-6D49-4EAC-8993-C1F0FF545B67}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
Avery Wizard 5.0 (HKLM-x32\...\{FC3B3A5D-7058-4627-9F1E-F95CC38B6054}) (Version: 5.0.5 - Avery)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5646 - AVG Technologies)
AVG 2015 (Version: 15.0.4273 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5646 - AVG Technologies) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 2070 Bluetooth 3.0 (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.5600 - Broadcom Corporation)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.350.6 - Broadcom Corporation)
ccc-core-static (x32 Version: 2010.0805.358.5180 - ATI) Hidden
CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.75.0.2014 - Georgy Berdyshev)
Corel Home Office - CS Templates (x32 Version: 5.6 - 公司名称) Hidden
Corel Home Office - CT Templates (x32 Version: 5.6 - 您的公司名稱) Hidden
Corel Home Office - IPM (x32 Version: 5.6 - Corel Corporation) Hidden
Corel Home Office - JP Templates (x32 Version: 5.6 - 会社名) Hidden
Corel Home Office - KR Templates (x32 Version: 5.6 - 회사명) Hidden
Corel Home Office - Launcher (x32 Version: 5.6 - Corel Corporation) Hidden
Corel Home Office - Templates RU (x32 Version: 5.6 - Название организации) Hidden
Corel Home Office - Templates1 (x32 Version: 5.6 - Your Company Name) Hidden
Corel Home Office (HKLM-x32\...\_{36C95AD3-D330-4BAA-884A-9F3EFD15A5EA}) (Version: 5.0.85.588 - Corel Corporation)
Corel Home Office (x32 Version: 5.6 - Corel Corporation) Hidden
CUEcards 2000 (HKLM-x32\...\CUEcards 2000) (Version:  - Marcus Humann Software-Technik)
Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 5.0.1.5 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (HKLM-x32\...\Drive Encryption) (Version: 5.0.4.0 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (Version: 5.0.4.0 - Hewlett-Packard) Hidden
Elements 11 Organizer (x32 Version: 11.0 - Ihr Firmenname) Hidden
Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
Epson Event Manager (HKLM-x32\...\{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}) (Version: 2.40.0001 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON SX525WD Series Handbuch (HKLM-x32\...\EPSON SX525WD Series Manual) (Version:  - )
EPSON SX525WD Series Netzwerk-Handbuch (HKLM-x32\...\EPSON SX525WD Series Network Guide) (Version:  - )
EPSON SX525WD Series Printer Uninstall (HKLM\...\EPSON SX525WD Series) (Version:  - SEIKO EPSON Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
EpsonNet Setup 3.3 (HKLM-x32\...\{C9D8A041-2963-4B31-8FFC-1500F3DB9293}) (Version: 3.3a - SEIKO EPSON CORPORATION)
Face Recognition for HP ProtectTools (HKLM\...\{E793990C-90BE-4B69-AC29-BF5E8FD4ED54}) (Version: 2.02.4007 - Hewlett-Packard)
File Sanitizer For HP ProtectTools (HKLM-x32\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 5.0.1.2 - Hewlett-Packard)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Heizkosten (HKLM-x32\...\{373F123D-878C-4B89-B2D4-218C29273B98}) (Version: 6.5.0 - KV Software)
HP 3D DriveGuard (HKLM\...\{67C090D6-109A-47D7-8DED-4160C4D96F32}) (Version: 4.0.4.1 - Hewlett-Packard)
HP Documentation (HKLM-x32\...\{D21160A2-8B5F-409C-99C8-03582F5324B7}) (Version: 1.7.0.0 - Hewlett-Packard)
HP ESU for Microsoft Windows 7 (HKLM-x32\...\{D9989A13-B173-4048-B8A5-93C204DCB1B3}) (Version: 1.1.6.1 - Hewlett-Packard Company)
HP HotKey Support (HKLM\...\{4BBA5224-C5B1-4B8C-AAA4-68DA6654B9C1}) (Version: 3.5.15.1 - Hewlett-Packard Company)
HP Power Assistant (HKLM\...\{32C278B2-BC1F-4018-8FB4-2012A40D9FC1}) (Version: 1.0.9.0 - Hewlett-Packard Company)
HP Power Data (HKLM\...\{F2177395-FD90-44B0-AFB8-2E0566855E5C}) (Version: 1.0.31.182 - Hewlett-Packard)
HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 5.03.637 - Hewlett-Packard)
HP QuickLook (HKLM\...\{E6BEE2A9-04CF-42FF-B95B-BB70FAD2DC3E}) (Version: 3.3.1.2 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{7861911B-4270-498A-8F7A-FCF0570F487D}) (Version: 1.0.1.63 - DeviceVM, Inc.)
HP Setup (HKLM-x32\...\{E7C34ED4-BBB6-4C57-9FBD-B29CA5878051}) (Version: 8.5.4371.3505 - Hewlett-Packard Company)
HP SoftPaq Download Manager (HKLM-x32\...\{2DA697D7-FED3-4DE2-A174-92A2A12F9688}) (Version: 3.0.5.0 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{E05DB9F9-C8E7-45F2-BE9E-76D4C447CE9B}) (Version: 4.0.39.1 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\...\{04801E42-B1A6-4C52-9F3D-CADB5A050433}) (Version: 7.0.1.9 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{FC17E0A7-EAA9-4902-92F8-C83B9FD02246}) (Version: 5.0.14.2 - Hewlett-Packard Company)
HP Webcam Driver (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.50016.0 - Sonix)
HP Wireless Assistant (HKLM\...\{EC720706-3F19-4B7F-BDDD-E31D9B3921D2}) (Version: 4.0.6.0 - Hewlett-Packard)
HPAsset component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6275.0 - IDT)
Image Data Converter (HKLM-x32\...\{87998E4E-6D9C-411B-AAE9-B8523FFE357D}) (Version: 4.2.00.07270 - Sony Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.01.01.1007 - Intel Corporation)
Isovar 2015 Version 1.3.7.0 (HKLM-x32\...\{79E7FC4B-F866-48A0-85AA-0A44DFB3E208}_is1) (Version: 1.3.7.0 - ascendere IT-Systeme)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
LightScribe System Software (HKLM-x32\...\{82EF29B1-9B60-4142-A155-0599216DD053}) (Version: 1.18.6.1 - LightScribe)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MeineBeihilfe2009 (HKLM-x32\...\{AE926A81-E487-4D5D-9031-1EDB3242F943}) (Version: 10.54.0.0 - ComputerService)
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM-x32\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Access Runtime (German) 2007 (HKLM-x32\...\{90120000-001C-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mp3tag v2.66 (HKLM-x32\...\Mp3tag) (Version: v2.66 - Florian Heidenreich)
No23 Recorder (HKLM-x32\...\No23 Recorder) (Version: 2.1.0.3 - No23)
No23 Recorder (x32 Version: 2.1.0.3 - No23) Hidden
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.20.0 - Symantec)
paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
PDF Complete Special Edition (HKLM-x32\...\PDF Complete) (Version: 3.5.112 - PDF Complete, Inc)
PlayMemories Home (HKLM-x32\...\{8EB84CEC-6819-4E51-9E32-C756835637B0}) (Version: 6.3.03.08201 - Sony Corporation)
Pre-Boot Security for HP ProtectTools (Version: 5.0.7.1 - Hewlett-Packard) Hidden
Privacy Manager for HP ProtectTools (HKLM\...\{04255D34-6C6D-4F63-A218-EE8FD2D13AF0}) (Version: 5.10.796 - Hewlett-Packard)
PSE11 STI Installer (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 1.12.0011 - Realtek)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30109 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version: 3.2.43 - Saal Digital Fotoservice GmbH)
Saal Design Software (x32 Version: 3.2.43 - Saal Digital Fotoservice GmbH) Hidden
Samsung Multimedia Studio 1.0 (HKLM-x32\...\Samsung Multimedia Studio_is1) (Version:  - Samsung)
SecurityUtility (HKLM-x32\...\SecurityUtility) (Version: 1.0.0.1919 - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SonyEditor (remove only) (HKLM-x32\...\SonyEditor) (Version:  - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated)
Theft Recovery (HKLM-x32\...\InstallShield_{33C9F24B-1D92-4632-A915-81E3BB1D5D6B}) (Version: 5.1.0.18 - Hewlett-Packard)
Theft Recovery (x32 Version: 5.1.0.18 - Hewlett-Packard) Hidden
Validity Fingerprint Driver (HKLM\...\{516DA517-73A0-40F8-8CD9-E5ED4EC383E5}) (Version: 4.0.10.0 - Validity Sensors, Inc.)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
WDR RadioRecorder (HKLM-x32\...\Tobit Radio.fx Server 1) (Version:  - Tobit.Software)
Windows 7 Default Setting (HKLM-x32\...\{5BF8E079-D6E2-4323-B794-75152371122A}) (Version: 1.0.1.6 - Hewlett-Packard Company)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinZip 14.5 (HKLM-x32\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}) (Version: 14.5.9095 - WinZip Computing, S.L. )
XnView 2.25 (HKLM-x32\...\XnView_is1) (Version: 2.25 - Gougelet Pierre-e)
YH-925 Driver & Utilities (HKLM-x32\...\{5C0BFEB4-4A1B-439C-91AC-9AED106DA213}) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

ATTENTION: System Restore is disabled.
Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => ?

==================== Loaded Modules (whitelisted) =============

2010-06-08 23:55 - 2010-06-08 23:55 - 00173856 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2010-06-19 01:25 - 2010-06-19 01:25 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HardwareAccess.dll
2010-06-19 01:25 - 2010-06-19 01:25 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HPCommon.XmlSerializers.dll
2010-06-19 01:25 - 2010-06-19 01:25 - 00055864 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\Graphs.dll
2010-06-22 02:54 - 2010-06-22 02:54 - 00098304 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-08-05 12:57 - 2010-08-05 12:57 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-04-05 20:11 - 2010-04-05 20:11 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2010-04-05 20:12 - 2010-04-05 20:12 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2010-04-05 20:12 - 2010-04-05 20:12 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ColorMedia => ""="service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2226251454-2989245828-1209764460-500 - Administrator - Disabled)
bfzadm (S-1-5-21-2226251454-2989245828-1209764460-1001 - Administrator - Enabled) => C:\Users\bfzadm
bfzn (S-1-5-21-2226251454-2989245828-1209764460-1004 - Limited - Enabled) => C:\Users\bfzn
Gast (S-1-5-21-2226251454-2989245828-1209764460-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2226251454-2989245828-1209764460-1005 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service: 
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 


==================== Event log errors: =========================

Application errors:
==================
Error: (01/31/2015 00:41:40 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "1, 2, 0, 17" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (01/30/2015 08:38:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 804

Startzeit: 01d03cc3dafd7e5c

Endzeit: 31

Anwendungspfad: C:\windows\Explorer.EXE

Berichts-ID: 90073b1b-a8b7-11e4-aad6-e02a829ab71c

Error: (01/28/2015 10:32:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Name des fehlerhaften Moduls: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000011aa
ID des fehlerhaften Prozesses: 0x2aa8
Startzeit der fehlerhaften Anwendung: 0xGmer-19357.exe0
Pfad der fehlerhaften Anwendung: Gmer-19357.exe1
Pfad des fehlerhaften Moduls: Gmer-19357.exe2
Berichtskennung: Gmer-19357.exe3

Error: (01/28/2015 08:34:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2310001

Error: (01/28/2015 08:34:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2310001

Error: (01/28/2015 08:34:37 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (01/27/2015 10:02:11 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "1, 2, 0, 17" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (01/27/2015 00:52:45 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17496 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 19d4

Startzeit: 01d0398e6544cf3b

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (01/26/2015 11:56:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17496 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 24e4

Startzeit: 01d039ba738d5e01

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (01/25/2015 11:46:15 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "1, 2, 0, 17" des "version"-Attributs im assemblyIdentity-Element ist ungültig.


System errors:
=============
Error: (01/31/2015 01:12:17 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\windows\System32\bcmihvsrv64.dll

Error: (01/31/2015 01:12:17 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\windows\System32\bcmihvsrv64.dll

Error: (01/31/2015 01:12:07 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\windows\System32\bcmihvsrv64.dll

Error: (01/31/2015 01:11:07 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (01/31/2015 01:10:38 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Office Software Protection Platform" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/31/2015 01:10:37 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/31/2015 01:10:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Management & Security Application User Notification Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/31/2015 01:10:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Rapid Storage Technology" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/31/2015 01:10:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HP Wireless Assistant Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/31/2015 01:10:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HP Power Assistant Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (01/31/2015 00:41:40 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversion1, 2, 0, 17c:\Program Files (x86)\Arcsoft\TotalMedia Suite\TotalMedia Studio MV\CaptureModule.exe.Manifestc:\Program Files (x86)\Arcsoft\TotalMedia Suite\TotalMedia Studio MV\CaptureModule.exe.Manifest3

Error: (01/30/2015 08:38:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.1.7601.1756780401d03cc3dafd7e5c31C:\windows\Explorer.EXE90073b1b-a8b7-11e4-aad6-e02a829ab71c

Error: (01/28/2015 10:32:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Gmer-19357.exe2.1.19357.052e7ea83Gmer-19357.exe2.1.19357.052e7ea83c0000005000011aa2aa801d03b41dc171e26C:\Users\bfzn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4QT7IUK6\Gmer-19357.exeC:\Users\bfzn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4QT7IUK6\Gmer-19357.exe22621dad-a735-11e4-8718-e02a829ab71c

Error: (01/28/2015 08:34:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2310001

Error: (01/28/2015 08:34:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2310001

Error: (01/28/2015 08:34:37 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (01/27/2015 10:02:11 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversion1, 2, 0, 17c:\Program Files (x86)\Arcsoft\TotalMedia Suite\TotalMedia Studio MV\CaptureModule.exe.Manifestc:\Program Files (x86)\Arcsoft\TotalMedia Suite\TotalMedia Studio MV\CaptureModule.exe.Manifest3

Error: (01/27/2015 00:52:45 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.1749619d401d0398e6544cf3b0C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (01/26/2015 11:56:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.1749624e401d039ba738d5e010C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (01/25/2015 11:46:15 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversion1, 2, 0, 17c:\Program Files (x86)\Arcsoft\TotalMedia Suite\TotalMedia Studio MV\CaptureModule.exe.Manifestc:\Program Files (x86)\Arcsoft\TotalMedia Suite\TotalMedia Studio MV\CaptureModule.exe.Manifest3


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5 CPU M 480 @ 2.67GHz
Percentage of memory in use: 60%
Total physical RAM: 3951.43 MB
Available physical RAM: 1578.24 MB
Total Pagefile: 7901.04 MB
Available Pagefile: 4731.89 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:448.47 GB) (Free:188.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.48 GB) FAT32
Drive p: () (Network) (Total:448.47 GB) (Free:188.29 GB) NTFS

==================== MBR & Partition Table ==================

==================== End Of Log ============================

Alt 31.01.2015, 14:04   #12
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Meldung in Win7: Der Proxyserver reagiert nicht


Bevor wir in die letzte Phase der Bereinigung starten:

Gibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 31.01.2015, 14:46   #13
BerndFranzen
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Probleme?


Als ich mich hier gemeldet hatt, gab es zwei Probleme: Die Anmeldung an WEB.DE und FACEBOOK.de liefen ins Leere.

Ich habe beides gerade probiert - funktioniert!

Aus meiner Sicht kann die Aktion abgeschlossen werden, Vielen Dank.

P.S. Wenn es nicht so ernst wäre, könnte ich glatt sagen: Diese Aktion hat Spaß gemacht. Die Anleitungen und Hilfen waren Klasse und vor allen Dingen immer eindeutig.

Alt 31.01.2015, 14:47   #14
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Meldung in Win7: Der Proxyserver reagiert nicht


Zitat:
Zitat von BerndFranzen Beitrag anzeigen

Aus meiner Sicht kann die Aktion abgeschlossen werden, Vielen Dank.
Gerne! Aber wir sind noch nicht fertig...

Schritt 1

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 02.02.2015, 05:46   #15
BerndFranzen
 
Meldung in Win7: Der Proxyserver reagiert nicht - Standard

Meldung in Win7: Der Proxyserver reagiert nicht


Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=b8afac076305bc46beefe74a3c3205d8
# engine=22242
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-01-31 03:15:47
# local_time=2015-01-31 04:15:47 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='AVG AntiVirus Free Edition 2015'
# compatibility_mode=1055 16777213 100 100 72321 109851331 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 5003286 174347197 0 0
# scanned=176800
# found=15
# cleaned=0
# scan_time=4141
sh=497D88F38E21229D95650E02708207190CB6849E ft=1 fh=64a74ba51bf40770 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchCH.dll.vir"
sh=5468230F587DE9F869DB9E22083131DCFD9451F2 ft=1 fh=07a842c13464288e vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchFF.dll.vir"
sh=5D628376391A827A818B0A079B64EE457AE9B82A ft=1 fh=c71c0011e2e7a7a5 vn="Variante von Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowserAction.dll.vir"
sh=599F4EB498D7C05A680386C1D3E1FC3DD68A8FA9 ft=1 fh=bd87bce3b868a7f1 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\CmdShell.exe.vir"
sh=6F2DDAFE7B526A4CC60D75CCB1D4EBEA6F5D0DDC ft=1 fh=a836ee7136df2313 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\HPNotify.exe.vir"
sh=1DFF39C0F7B7617C8292510F1833B282CD0A1F21 ft=1 fh=18ddbd645dd0ae9c vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\IeWatchDog.dll.vir"
sh=DF7B974F73F65FDF917E9C3AB8B8EC9FD97FC2A0 ft=1 fh=0e3a711fc1c46ea8 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ProtectService.exe.vir"
sh=606D4414333C04E362F60B505926C78BB0B6C694 ft=1 fh=2f7c44d7fdd8d932 vn="Variante von Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\SupTab.dll.vir"
sh=07ADF9F176FE22502D214F37E04D91138C1A5E0F ft=1 fh=ab1e35588ec90b85 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AVG\AVG2015\Notification\avg_ask_tb.exe"
sh=B4775C5289AB79697973E987508379D6F07CDACD ft=1 fh=06a63e11479f4987 vn="Variante von Win32/Adware.AdService.J Anwendung" ac=I fn="C:\Users\bfzadm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7AGMUJ67\dl[1].htm"
sh=B6913DA229C696B9BB895746B1F333B29D1A885E ft=1 fh=325ac70b4c58064e vn="Variante von Win32/Adware.ConvertAd.Q Anwendung" ac=I fn="C:\Users\bfzadm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JTTKRSIU\WinCheckSetup[1].exe"
sh=1BAF9AE1C3A4B5E12F49C60C3662BBDC0190B49B ft=1 fh=9411dea1f161cee2 vn="Variante von Win32/InstallCore.VD evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bfzadm\AppData\Local\Temp\ICReinstall_cdn_adsearchesfiles_com[1].exe"
sh=B6913DA229C696B9BB895746B1F333B29D1A885E ft=1 fh=325ac70b4c58064e vn="Variante von Win32/Adware.ConvertAd.Q Anwendung" ac=I fn="C:\Users\bfzadm\AppData\Local\Temp\nsrAE63.tmp"
sh=082032CD5EB1E638D7329EF53FEBBF836B2CF3AA ft=1 fh=588f6b3b1596634d vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bfzn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PXZ9S0ZJ\SonyEditor - CHIP-Installer.exe"
sh=FB3F7E2BF56F5EA06763303CDAA0E962E975E063 ft=1 fh=c0dea5299389dc4e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bfzn\AppData\Local\Temp\DMR\dmr_72.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=b8afac076305bc46beefe74a3c3205d8
# engine=22254
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-02 12:14:56
# local_time=2015-02-02 01:14:56 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='AVG AntiVirus Free Edition 2015'
# compatibility_mode=1055 16777213 100 100 30365 109970080 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 5125635 174465946 0 0
# scanned=318408
# found=13
# cleaned=0
# scan_time=8270
sh=497D88F38E21229D95650E02708207190CB6849E ft=1 fh=64a74ba51bf40770 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchCH.dll.vir"
sh=5468230F587DE9F869DB9E22083131DCFD9451F2 ft=1 fh=07a842c13464288e vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchFF.dll.vir"
sh=5D628376391A827A818B0A079B64EE457AE9B82A ft=1 fh=c71c0011e2e7a7a5 vn="Variante von Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowserAction.dll.vir"
sh=599F4EB498D7C05A680386C1D3E1FC3DD68A8FA9 ft=1 fh=bd87bce3b868a7f1 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\CmdShell.exe.vir"
sh=6F2DDAFE7B526A4CC60D75CCB1D4EBEA6F5D0DDC ft=1 fh=a836ee7136df2313 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\HPNotify.exe.vir"
sh=1DFF39C0F7B7617C8292510F1833B282CD0A1F21 ft=1 fh=18ddbd645dd0ae9c vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\IeWatchDog.dll.vir"
sh=DF7B974F73F65FDF917E9C3AB8B8EC9FD97FC2A0 ft=1 fh=0e3a711fc1c46ea8 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ProtectService.exe.vir"
sh=606D4414333C04E362F60B505926C78BB0B6C694 ft=1 fh=2f7c44d7fdd8d932 vn="Variante von Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\SupTab.dll.vir"
sh=B4775C5289AB79697973E987508379D6F07CDACD ft=1 fh=06a63e11479f4987 vn="Variante von Win32/Adware.AdService.J Anwendung" ac=I fn="C:\Users\bfzadm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7AGMUJ67\dl[1].htm"
sh=1BAF9AE1C3A4B5E12F49C60C3662BBDC0190B49B ft=1 fh=9411dea1f161cee2 vn="Variante von Win32/InstallCore.VD evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bfzadm\AppData\Local\Temp\ICReinstall_cdn_adsearchesfiles_com[1].exe"
sh=B6913DA229C696B9BB895746B1F333B29D1A885E ft=1 fh=325ac70b4c58064e vn="Variante von Win32/Adware.ConvertAd.Q Anwendung" ac=I fn="C:\Users\bfzadm\AppData\Local\Temp\nsrAE63.tmp"
sh=082032CD5EB1E638D7329EF53FEBBF836B2CF3AA ft=1 fh=588f6b3b1596634d vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bfzn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PXZ9S0ZJ\SonyEditor - CHIP-Installer.exe"
sh=FB3F7E2BF56F5EA06763303CDAA0E962E975E063 ft=1 fh=c0dea5299389dc4e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bfzn\AppData\Local\Temp\DMR\dmr_72.exe"

Antwort
Seite 1 von 2 1 2

Themen zu Meldung in Win7: Der Proxyserver reagiert nicht
andere, aufruf, aufrufe, erhalte, erscheine, erscheinen, genannt, laufe, laufen, lästige, meldung, proxyserver, reagiert, reagiert nicht, seite, seiten, tagen, tools, vermehrt, win, win7, windows7 proxyserver


« Tabs öffnen sich automatisch | Probleme mit Positive Finds »


Ähnliche Themen: Meldung in Win7: Der Proxyserver reagiert nicht


  1. Proxyserver ließ sich nicht abschalten / durch Malewarebyte behoben / System wieder Clean?
    Log-Analyse und Auswertung - 23.04.2015 (22)
  2. Win7-Laptop von ASUS reagiert stark verzögert und hängt immer wieder
    Plagegeister aller Art und deren Bekämpfung - 14.04.2015 (11)
  3. Proxyserver reagiert nicht ...
    Plagegeister aller Art und deren Bekämpfung - 29.03.2015 (4)
  4. Win7 neu aufgesetzt - Windows reagiert verzögert, Browser laden Seiten extrem langsam, Downloads brechen ab oder dauern ewig
    Alles rund um Windows - 23.12.2014 (10)
  5. Win7 Rechner nach 5-10 festgefahren, kein Programm reagiert mehr
    Log-Analyse und Auswertung - 30.11.2014 (17)
  6. Win7 .dll meldung
    Plagegeister aller Art und deren Bekämpfung - 23.11.2014 (25)
  7. Win7_Rechner hängt/Internet langsam/ständig Meldung: Plug-in (Shockwave Flash / oder Flash Player) hängt oder reagiert nicht
    Plagegeister aller Art und deren Bekämpfung - 15.11.2014 (19)
  8. Win7 pro 64bit GUV virus mit Fedpol Meldung
    Log-Analyse und Auswertung - 03.11.2014 (1)
  9. WIN7: Internet reagiert kaum
    Plagegeister aller Art und deren Bekämpfung - 20.10.2014 (6)
  10. Packard Bell EasyNote Ts, Win7:Touchpad reagiert nicht mehr und MP3, den erkannt, aber nicht eingelesen
    Plagegeister aller Art und deren Bekämpfung - 07.09.2014 (18)
  11. proxyserver reagiert nicht nach trojaner-befall
    Log-Analyse und Auswertung - 07.06.2014 (5)
  12. Win7 64Bit; IE 11 reagiert nicht
    Log-Analyse und Auswertung - 24.03.2014 (3)
  13. System (Win7) reagiert stetig langsamer & fehlerhafter
    Log-Analyse und Auswertung - 07.03.2014 (19)
  14. Taskmanager öffnet nicht, Browser reagiert nicht, XP kann nicht herunter gefahren werden.
    Plagegeister aller Art und deren Bekämpfung - 18.02.2014 (3)
  15. Win7 - Avira Meldung im Bericht - Die Datei existiert nicht! AVARKT.DLL
    Log-Analyse und Auswertung - 08.12.2013 (13)
  16. Beim Runterfahren Meldung: "Programm reagiert nicht m" ein Virus?
    Log-Analyse und Auswertung - 02.06.2012 (7)
  17. Win7 herunterfahren Button reagiert nicht, strg+alt+entf geht nicht mehr & cmd.exe geht nicht auf
    Plagegeister aller Art und deren Bekämpfung - 15.12.2011 (25)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Meldung in Win7: Der Proxyserver reagiert nicht - Seit ein paar Tagen erhalte ich beim Aufruf der Seiten <freemail.de> und <Facebook.de> die Meldung "Der Proxyserver reagiert nicht". Andere Seiten lassen sich aufrufen. Außerdem erscheinen vermehrt lästige PopUps. Ich - Meldung in Win7: Der Proxyserver reagiert nicht...
Archiv
Du betrachtest: Meldung in Win7: Der Proxyserver reagiert nicht auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131