advare gen4, dealply, browse fox...

blessy · 31.01.2015, 14:28

ok ihr Lieben,

danke für die Aufnahme.

Das notebook von meiner Tochter ist so langsam, dass man es kaum glauben kann.
Ich habe zuviele Bilder und Videos dort gelagert, aber da ich wohl Trojaner habe,
trau ich mich nicht, diese Sachen auf meine ext. Festplatte zu ziehen.

Er war aber vorher schon im Schneckentempo, denn meine Tochter hat gefühlte
500 Video-Bearbeitungsprogramme uvm. heruntergeladen, die sich offensichtlich ggs ausbremsen.
Kann nicht so viel löschen wie ich möchte, weil ich mich zu wenig auskenne.

Avira hat 3.5 Std. zum scannen gebraucht

Und bevor ich herum experimentiere, möchte/muss ich erst einmal meine Daten retten.

inspiron mini, windows 7 starter
CDs habe ich keine, aber die Lizenzaufkleber auf der Rückseite

Ich wohne in Berlin, kenne einen kleinen PC-Laden, dem ich wohl traue, aber nichts ist umsonst.

Danke schonmal für eure Hilfe, werde morgen wohl wieder online sein.

LG Hilde

schrauber · 31.01.2015, 14:50

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

blessy · 31.01.2015, 16:45

morgen mach ich mich drsn und bin schon jetzt gespannt
LG Hilde

schrauber · 31.01.2015, 21:29

ok

blessy · 03.02.2015, 18:49

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-02-2015
Ran by user (administrator) on USER-PC on 03-02-2015 18:32:30
Running from C:\Users\user\Desktop\New folder
Loaded Profiles: user (Available profiles: user)
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
(Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\BCMWLTRY.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\ProgramData\DatacardService\HWDeviceService.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
() C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Dell) C:\Program Files\Battery Meter\BTMeter.exe
(Compal Electronics, Inc) C:\Program Files\CapsLKNotify\CapsLKNotify.exe
() C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtcmd.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtsvc.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.54\opera.exe
() C:\Program Files\Opera\27.0.1689.54\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.54\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.54\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.54\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.54\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.54\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.54\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.54\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.54\opera.exe
() C:\Program Files\Opera\27.0.1689.54\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.54\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.54\opera.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7547424 2009-06-16] (Realtek Semiconductor)
HKLM\...\Run: [BTMeter] => C:\Program Files\Battery Meter\BTMeter.exe [623984 2009-07-22] (Dell)
HKLM\...\Run: [CapsLKNotify] => C:\Program Files\CapsLKNotify\CapsLKNotify.exe [320880 2009-06-10] (Compal Electronics, Inc)
HKLM\...\Run: [Dell DataSafe Online] => C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe [1779952 2009-07-07] ()
HKLM\...\Run: [dellsupportcenter] => C:\Program Files\Dell Support Center\bin\sprtcmd.exe [206064 2009-06-03] (SupportSoft, Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2015-01-08] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {32dabb42-1886-11df-a82d-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {35602fa2-3550-11e2-a74d-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {35602fc7-3550-11e2-a74d-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {4757b95a-a385-11e3-83f0-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {5340d7e2-77c1-11e2-9d8e-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {5340d7f7-77c1-11e2-9d8e-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {5f59a581-fe5f-11de-9b42-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {5f59a59b-fe5f-11de-9b42-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {780be736-ff86-11de-ae2b-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {8b8cad91-cef2-11df-95d4-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {8b8cadc5-cef2-11df-95d4-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {a36f5ff3-8937-11df-af67-806e6f6e6963} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {b5cd9526-0cf6-11e0-8264-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {be2c2944-3718-11e2-a674-001e101f8aaa} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {d6c5e785-cd61-11df-9550-0c6076ff0764} - D:\AutoRun.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Mysearchdial Search
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\Software\Microsoft\Internet Explorer\Main,Start Page = Mysearchdial Search
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Dell - The Official Site | Dell Malaysia
URLSearchHook: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} -  No File
SearchScopes: HKLM -> DefaultScope {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKLM -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> DefaultScope {3ADA25D8-6B8E-4174-99B0-0340EBF9F87F} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=VIATDF&PC=VIATDF&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {3ADA25D8-6B8E-4174-99B0-0340EBF9F87F} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80196&lng=de
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {E1FB93A2-C203-4F7F-AD9B-8F1199E23FA5} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=kw&q={searchTerms}&locale=&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=b746bf59-8f6b-41c6-bd8f-56cdb4ce0ab3&apn_sauid=98616C0B-6F63-4D56-9456-89E6F03B5759
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File
Toolbar: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> No Name - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} -  No File
Toolbar: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{08650572-AE47-4832-8BDE-956C2964F5A3}: [NameServer] 212.23.115.148 212.23.115.150
Tcpip\..\Interfaces\{7B4B1029-983A-4AA6-BF81-6C41A7CFACF4}: [NameServer] 212.23.115.150 212.23.115.84
Tcpip\..\Interfaces\{D7E13746-1E44-4176-8C66-3FEF74D3DFE5}: [NameServer] 212.23.115.148 212.23.115.132

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default
FF SearchEngineOrder.1: Mysearchdial
FF Homepage: about:home
FF Keyword.URL: 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\searchplugins\Mysearchdial.xml
FF Extension: DownloadHelper - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-01-25]
FF Extension: 1-Click YouTube Video Downloader - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2015-01-25]
FF Extension: MySearchDial - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\Extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi [2014-07-30]

Chrome: 
=======
CHR HomePage: Default -> hxxp://start.mysearchdial.com/?f=1&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR DefaultSearchKeyword: Default -> mysearchdial.com
CHR DefaultSearchURL: Default -> hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-20]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-20]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-06]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-20]
CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-20]
CHR Extension: (Avira Browser Safety) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-08-06]
CHR Extension: (Google Wallet) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-20]
CHR Extension: (MySearchDial) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff [2014-04-24]
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-20]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\user\AppData\Local\mysearchdial-speeddial.crx [2013-12-20]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2015-01-08] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2015-01-08] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
S3 Blackberry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited) [File not signed]
S3 getPlusHelper; C:\Program Files\NOS\bin\getPlus_Helper.dll [51384 2009-12-01] (NOS Microsystems Ltd.)
R2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] ()
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S2 Mobile Partner. RunOuc; C:\Program Files\Mobile Partner\UpdateDog\ouc.exe [246112 2013-02-15] ()
R2 sprtsvc_DellSupportCenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968 2009-06-03] (SupportSoft, Inc.)
R2 UI Assistant Service; C:\Program Files\1&1 Surf-Stick\AssistantServices.exe [270672 2012-01-17] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-08-27] (Microsoft Corporation)
R2 wltrysvc; C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe [3086848 2009-07-17] (Dell Inc.) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AVerFx2hbtv; C:\Windows\System32\drivers\AVerFx2hbtv.sys [253824 2009-07-13] (AVerMedia TECHNOLOGIES, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2015-01-08] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-01-08] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-07-23] (Avira Operations GmbH & Co. KG)
R3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2009-07-17] (Broadcom Corporation)
R0 EMSC; C:\Windows\System32\DRIVERS\EMSC.SYS [13680 2009-06-26] (Windows (R) Win 7 DDK provider)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-03-26] (MBB Incorporated)
S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-13] (Ralink Technology Corp.)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2011-03-14] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2011-03-14] (RapidSolution Software AG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-07-23] (Avira GmbH)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 hwusbfake; system32\DRIVERS\ewusbfake.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-03 18:31 - 2015-02-03 18:32 - 00000000 ___DC () C:\FRST
2015-01-27 19:44 - 2015-01-27 19:44 - 00001011 ____C () C:\Users\Public\Desktop\StreamTransport.lnk
2015-01-27 19:44 - 2015-01-27 19:44 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StreamTransport
2015-01-27 19:43 - 2015-01-27 19:44 - 00000000 ___DC () C:\Program Files\StreamTransport
2015-01-27 19:41 - 2015-01-27 19:41 - 17805707 ____C () C:\Users\user\Desktop\streamtransport_1.1.6.2.zip
2015-01-27 18:49 - 2015-01-27 18:49 - 00000000 ___DC () C:\Windows\pss
2015-01-25 21:00 - 2015-01-25 21:00 - 07165512 ____C () C:\Users\user\Downloads\wordpress-4.1-de_DE.zip
2015-01-24 14:47 - 2015-01-24 14:47 - 00351744 ____C () C:\Windows\Minidump\012415-24804-01.dmp
2015-01-15 18:54 - 2015-02-03 18:35 - 00000000 ___DC () C:\Users\user\Desktop\New folder
2015-01-15 18:39 - 2015-01-16 15:52 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-01-15 18:39 - 2015-01-16 15:52 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-15 18:39 - 2015-01-16 15:52 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-01-15 18:38 - 2015-01-17 12:41 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-15 18:38 - 2015-01-16 15:51 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-15 18:38 - 2015-01-16 15:51 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-15 18:38 - 2015-01-16 15:51 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-15 18:13 - 2015-01-15 18:13 - 00000000 _SHDC () C:\Users\user\AppData\Local\EmieUserList
2015-01-15 18:13 - 2015-01-15 18:13 - 00000000 _SHDC () C:\Users\user\AppData\Local\EmieSiteList
2015-01-15 18:13 - 2015-01-15 18:13 - 00000000 _SHDC () C:\Users\user\AppData\Local\EmieBrowserModeList
2015-01-14 12:17 - 2015-01-14 12:17 - 00000000 ___DC () C:\Windows\system32\appraiser
2015-01-14 11:46 - 2015-01-14 11:47 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-01-14 11:46 - 2015-01-14 11:47 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-01-14 11:46 - 2015-01-14 11:47 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-01-14 11:46 - 2015-01-14 11:47 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-01-14 11:46 - 2015-01-14 11:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-01-14 11:35 - 2015-01-14 11:35 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-01-14 11:17 - 2015-01-14 11:22 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2015-01-14 11:16 - 2015-01-14 11:22 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2015-01-14 11:16 - 2015-01-14 11:22 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2015-01-14 11:15 - 2015-01-14 11:22 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2015-01-11 19:45 - 2015-01-14 11:23 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2015-01-11 19:43 - 2015-01-14 12:00 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-01-11 19:43 - 2015-01-14 11:58 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-01-11 19:43 - 2015-01-14 11:58 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-01-11 19:43 - 2015-01-14 11:56 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-01-11 19:43 - 2015-01-14 11:56 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2015-01-11 19:42 - 2015-01-14 11:48 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2015-01-11 19:42 - 2015-01-14 11:46 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-01-11 19:42 - 2015-01-14 11:45 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-01-11 19:42 - 2015-01-14 11:44 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-01-11 19:42 - 2015-01-14 11:44 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-01-11 19:41 - 2015-01-14 11:42 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-01-11 19:41 - 2015-01-14 11:41 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-01-11 19:41 - 2015-01-14 11:36 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-01-11 19:41 - 2015-01-14 11:36 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-01-11 19:41 - 2015-01-14 11:36 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-01-11 19:41 - 2015-01-14 11:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-01-11 19:41 - 2015-01-14 11:34 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-01-11 19:40 - 2015-01-14 11:38 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-01-11 19:40 - 2015-01-14 11:36 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-01-11 19:40 - 2015-01-14 11:36 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-01-11 19:40 - 2015-01-14 11:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-01-11 19:40 - 2015-01-14 11:36 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-01-11 19:39 - 2015-01-14 11:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-01-11 19:39 - 2015-01-14 11:24 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-01-11 19:39 - 2015-01-14 11:09 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2015-01-11 19:39 - 2015-01-14 11:09 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2015-01-11 19:39 - 2015-01-14 11:09 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2015-01-11 19:38 - 2015-01-11 21:08 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-01-11 19:38 - 2015-01-11 21:08 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2015-01-11 19:35 - 2015-01-11 20:47 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2015-01-11 19:35 - 2015-01-11 20:46 - 05703168 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-01-11 19:16 - 2015-01-11 20:44 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2015-01-11 19:16 - 2015-01-11 20:44 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2015-01-11 19:16 - 2015-01-11 20:44 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2015-01-11 19:16 - 2015-01-11 20:44 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2015-01-11 19:16 - 2015-01-11 20:44 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2015-01-11 19:13 - 2015-01-14 11:57 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-01-11 19:11 - 2015-01-14 11:49 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2015-01-11 19:11 - 2015-01-14 11:49 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2015-01-11 19:11 - 2015-01-14 11:49 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 00136632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-01-11 18:52 - 2015-01-14 11:24 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-01-11 18:52 - 2015-01-14 11:24 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-01-11 18:52 - 2015-01-14 11:24 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-01-11 18:52 - 2015-01-11 20:20 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2015-01-11 18:52 - 2015-01-11 20:20 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2015-01-11 18:52 - 2015-01-11 20:20 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2015-01-11 18:52 - 2015-01-11 20:20 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2015-01-11 18:52 - 2015-01-11 20:20 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2015-01-09 17:10 - 2015-01-27 18:23 - 00000000 __RDC () C:\Users\user\Dropbox
2015-01-09 17:10 - 2015-01-09 17:10 - 00001086 ____C () C:\Users\user\Desktop\Dropbox.lnk
2015-01-09 17:02 - 2015-01-09 17:02 - 00000000 ___DC () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-01-09 16:55 - 2015-01-27 16:31 - 00000000 ___DC () C:\Users\user\AppData\Roaming\Dropbox
2015-01-09 16:55 - 2015-01-09 16:55 - 00324112 ____C (Dropbox, Inc.) C:\Users\user\Downloads\DropboxInstaller.exe
2015-01-09 15:29 - 2015-01-09 15:30 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-01-09 15:29 - 2015-01-09 15:30 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-01-09 15:29 - 2015-01-09 15:30 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-01-09 15:29 - 2015-01-09 15:30 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-01-09 15:28 - 2015-01-09 15:49 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-01-09 15:28 - 2015-01-09 15:49 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-01-09 15:28 - 2015-01-09 15:49 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-01-09 15:27 - 2015-01-09 15:30 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-01-09 15:27 - 2015-01-09 15:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-01-08 17:15 - 2015-01-08 17:15 - 00335928 ____C () C:\Users\user\Desktop\Opera 12 Notes.html
2015-01-08 17:15 - 2015-01-08 17:15 - 00000000 ___DC () C:\Users\user\AppData\Roaming\Opera Software
2015-01-08 17:15 - 2015-01-08 17:15 - 00000000 ___DC () C:\Users\user\AppData\Local\Opera Software
2015-01-08 16:30 - 2015-01-08 16:30 - 00001057 ____C () C:\Users\Public\Desktop\Avira.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-03 18:34 - 2009-12-09 15:58 - 00000000 ___DC () C:\Users\user\AppData\Local\Adobe
2015-02-03 18:22 - 2009-07-14 05:55 - 01701627 _____ () C:\Windows\WindowsUpdate.log
2015-02-03 18:11 - 2009-07-14 05:34 - 00010272 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-03 18:11 - 2009-07-14 05:34 - 00010272 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-03 18:04 - 2013-08-26 21:29 - 00000830 ____C () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-03 08:47 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-03 08:47 - 2009-07-14 05:39 - 00220508 _____ () C:\Windows\setupact.log
2015-01-27 17:16 - 2010-10-01 15:04 - 00000000 ___DC () C:\Program Files\Opera
2015-01-26 23:17 - 2009-07-14 03:37 - 00000000 ___DC () C:\Windows\Microsoft.NET
2015-01-25 20:55 - 2014-08-14 18:22 - 00000000 ___DC () C:\Users\user\Desktop\tb
2015-01-25 18:53 - 2012-10-13 20:31 - 00701616 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-01-25 18:53 - 2011-07-16 20:44 - 00071344 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-01-24 22:48 - 2009-07-14 03:37 - 00000000 ___DC () C:\Windows\system32\NDF
2015-01-24 14:47 - 2011-05-26 10:04 - 235216202 _____ () C:\Windows\MEMORY.DMP
2015-01-24 14:47 - 2011-05-26 10:04 - 00000000 ___DC () C:\Windows\Minidump
2015-01-23 09:30 - 2011-11-03 01:20 - 00000000 ___DC () C:\Users\user\AppData\Local\MediaGet2
2015-01-20 18:50 - 2009-11-20 11:28 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-16 16:15 - 2013-08-27 00:28 - 00000000 ___DC () C:\Windows\system32\MRT
2015-01-16 15:53 - 2010-01-18 00:08 - 110348472 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-15 18:45 - 2010-01-12 08:18 - 00000000 ___DC () C:\Program Files\Google
2015-01-14 12:22 - 2009-07-14 05:33 - 00381176 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-14 12:17 - 2014-05-09 13:34 - 00000000 __SDC () C:\Windows\system32\CompatTel
2015-01-14 12:17 - 2009-07-14 03:37 - 00000000 ___DC () C:\Windows\AppCompat
2015-01-14 10:53 - 2009-11-20 13:11 - 00751992 _____ () C:\Windows\PFRO.log
2015-01-11 21:10 - 2010-10-11 13:17 - 00000000 ___DC () C:\ProgramData\Microsoft Help
2015-01-09 17:32 - 2014-07-30 11:53 - 00000000 ___DC () C:\Users\user\Desktop\stick
2015-01-09 16:20 - 2013-09-08 16:17 - 00002441 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-09 16:01 - 2010-12-13 20:29 - 00000000 ___DC () C:\Program Files\Mozilla Firefox
2015-01-09 02:52 - 2012-10-28 17:03 - 00000000 ___DC () C:\Users\user\Desktop\kim sammel
2015-01-08 16:31 - 2014-08-06 10:31 - 00000000 ___DC () C:\ProgramData\Package Cache
2015-01-08 16:30 - 2013-08-26 21:32 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-01-08 16:11 - 2014-08-14 18:18 - 00037384 ____C (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-01-08 16:10 - 2014-08-06 12:25 - 00136216 ____C (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-01-08 16:10 - 2014-08-06 12:25 - 00098160 ____C (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

==================== Files in the root of some directories =======

2013-08-24 20:43 - 2013-08-24 20:43 - 4188160 ____C () C:\Program Files\GUT2433.tmp
2013-04-01 00:50 - 2013-09-08 16:53 - 0000154 ____C () C:\Users\user\AppData\Roaming\Rim.Desktop.Exception.log
2013-04-01 00:48 - 2013-04-01 00:48 - 0001147 ____C () C:\Users\user\AppData\Roaming\Rim.Desktop.HttpServerSetup.log
2013-04-01 00:50 - 2013-09-08 16:53 - 0000154 ____C () C:\Users\user\AppData\Roaming\Rim.DesktopHelper.Exception.log
2010-01-11 01:39 - 2010-01-11 01:39 - 0008292 ____C () C:\Users\user\AppData\Roaming\UserTile.png
2010-01-10 21:42 - 2014-08-29 00:22 - 0001272 ____C () C:\Users\user\AppData\Roaming\wklnhst.dat
2011-04-02 23:15 - 2011-12-10 22:55 - 0048128 ____C () C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-12-20 12:51 - 2013-12-20 12:50 - 0351124 ____C () C:\Users\user\AppData\Local\mysearchdial-speeddial.crx
2011-06-24 12:58 - 2011-06-24 12:59 - 0000000 ____C () C:\Users\user\AppData\Local\{7B024D7D-8162-4DA4-8378-4BC395140FAA}
2010-01-12 08:24 - 2010-01-12 08:24 - 0000056 ___HC () C:\ProgramData\ezsidmv.dat

Some content of TEMP:
====================
C:\Users\user\AppData\Local\Temp\9564uninstall.exe
C:\Users\user\AppData\Local\Temp\AskSLib.dll
C:\Users\user\AppData\Local\Temp\avgnt.exe
C:\Users\user\AppData\Local\Temp\BlackBerryDeviceManager.exe
C:\Users\user\AppData\Local\Temp\ConduitEngine.dll
C:\Users\user\AppData\Local\Temp\contentDATs.exe
C:\Users\user\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplgwb6r.dll
C:\Users\user\AppData\Local\Temp\ffunzip.exe
C:\Users\user\AppData\Local\Temp\GLFC061.tmp.ConduitEngineSetup.exe
C:\Users\user\AppData\Local\Temp\GoogleToolbarInstaller.exe
C:\Users\user\AppData\Local\Temp\install_flashplayer16x32pp_chrd_dn_aaa_aih.exe
C:\Users\user\AppData\Local\Temp\jre-6u17-windows-i586-iftw-rv.exe
C:\Users\user\AppData\Local\Temp\jre-6u20-windows-i586-iftw-rv.exe
C:\Users\user\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\user\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\user\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\user\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\user\AppData\Local\Temp\MSN9B55.exe
C:\Users\user\AppData\Local\Temp\pcspeedmaxsetup.exe
C:\Users\user\AppData\Local\Temp\prxGLFC061.tmp.tbDVDV.dll
C:\Users\user\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\user\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\user\AppData\Local\Temp\setup.exe
C:\Users\user\AppData\Local\Temp\SkypeSetup.exe
C:\Users\user\AppData\Local\Temp\Sqlite3.dll
C:\Users\user\AppData\Local\Temp\tbDVDV.dll
C:\Users\user\AppData\Local\Temp\wlsetup-cvr.exe
C:\Users\user\AppData\Local\Temp\{74B7A0AE-A509-44AF-891D-96825A4598A3}-35.0.1916.153_35.0.1916.114_chrome_updater.exe
C:\Users\user\AppData\Local\Temp\{938A297E-9750-4411-B385-896C77F85AF5}-35.0.1916.114_chrome_installer.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 09:07

==================== End Of Log ============================

--- --- ---

--- --- ---

Huhu Schrauber - reicht das ?
Und das kann jetzt jeder hier lesen ?

LG Hilde

schrauber · 03.02.2015, 21:51

Die Addition.txt fehlt noch. Und ja, das kann jeder lesen. Da steht aber nix drin mit dem jemand hacken könnte oder so.

blessy · 05.02.2015, 18:10

Huhu Schrauber,
ich denke, du meinst dies hierFRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 01-02-2015
Ran by user at 2015-02-03 18:52:10
Running from C:\Users\user\Desktop\New folder
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

1&1 Surf-Stick (HKLM\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.2 - )
Acrobat.com (HKLM\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 2.0.0.0 - Adobe Systems Incorporated)
Acrobat.com (Version: 2.0.0 - Adobe Systems Incorporated) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.5.3.9120 - Adobe Systems Inc.)
Adobe Download Manager (HKLM\...\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}) (Version: 1.6.2.53 - NOS Microsystems Ltd.)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 PPAPI (HKLM\...\Adobe Flash Player PPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Audials (HKLM\...\{35FA05B1-FFFF-4687-9272-AA606808F67A}) (Version: 8.0.43807.700 - RapidSolution Software AG)
Audials TV (HKLM\...\{24EE4523-711A-4BD1-95EA-F73A8A6950D3}) (Version: 1.3.10803.300 - RapidSolution Software AG)
Avira (HKLM\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Battery Meter (HKLM\...\InstallShield_{543A4F31-9590-416A-A621-42CEB4C6A694}) (Version: 0.0.0.10C - )
Battery Meter (Version: 0.0.0.10C - ) Hidden
BE Downloadable Edition (HKLM\...\BE Downloadable Edition) (Version:  - WORDsearch Corp)
BE Downloadable Edition (Version: 1.1 - WORDsearch Corp) Hidden
BlackBerry Desktop Software 7.1 (HKLM\...\BlackBerry_Desktop) (Version: 7.1.0.41 - Research in Motion Ltd.)
BlackBerry Desktop Software 7.1 (Version: 7.1.0.41 - Research in Motion Ltd.) Hidden
BlackBerry Device Manager 7.0 (HKLM\...\BlackBerry_HandheldManager) (Version: 7.0.0.40 - Research in Motion Ltd.)
BlackBerry Device Manager 7.0 (Version: 7.0.0.40 - Research in Motion Ltd.) Hidden
CapsLKNotify (HKLM\...\InstallShield_{90578106-70AF-4198-B9DE-1924FA83B03A}) (Version: 0.1.0.5 - Dell)
CapsLKNotify (Version: 0.1.0.5 - Dell) Hidden
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Dell DataSafe Online (HKLM\...\{13766F76-6C8C-4E57-A9F3-3212D1C6E0D1}) (Version: 1.1.0029 - Dell, Inc.)
Dell Edoc Viewer (HKLM\...\{3138EAD3-700B-4A10-B617-B3F8096EE30D}) (Version: 1.0.0 - Dell Inc)
Dell Support Center (Support Software) (HKLM\...\{E3BFEE55-39E2-4BE0-B966-89FE583822C1}) (Version: 2.2.09085 - Dell)
Dell Webcam Central (HKLM\...\Dell Webcam Central) (Version: 1.03.04 - Creative Technology Ltd)
Dell Wireless WLAN Card Utility (HKLM\...\Dell Wireless WLAN Card Utility) (Version: 5.30.21.0 - Dell Inc.)
Dropbox (HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\Dropbox) (Version: 3.0.4 - Dropbox, Inc.)
EMSC (Version: 0.0.0.20C - Compal Electronics, Inc.) Hidden
Free YouTube to MP3 Converter version 3.9.40.602 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version:  - DVDVideoSoft Limited.)
Function Keys (Version: 0.1.0.6 - Dell) Hidden
GodTube Video Downloader 3.19 (HKLM\...\GodTube Video Downloader_is1) (Version:  - DownloadToolz, Inc.)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Java 7 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
MediaGet (HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MediaGet) (Version:  - Media Get LLC)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
Mobile Partner (HKLM\...\Mobile Partner) (Version: 21.005.15.00.705 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
Opera 12.11 (HKLM\...\Opera 12.11.1661) (Version: 12.11.1661 - Opera Software ASA)
Opera Stable 27.0.1689.54 (HKLM\...\Opera 27.0.1689.54) (Version: 27.0.1689.54 - Opera Software ASA)
PassNow 2014.5.13.43 (HKLM\...\{52728E2D-ED55-44CA-8640-E2CD22FAE771}_is1) (Version: 2014.5.13.43 - Rene.E Laboratory)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5874 - )
Skype Toolbars (HKLM\...\{981029E0-7FC9-4CF3-AB39-6F133621921A}) (Version: 1.0.4051 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
StreamTransport version: 1.1.6.2 (HKLM\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.1.2.0 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
WSED (Version: 0.1.0.15 - ) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.3.21.135\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.3.21.99\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{0C1EB979-8EC7-46E8-8097-246957D6B94C}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.3.21.57\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{1434DD3D-0AF6-41E0-BB71-8C86010D9AF5}\localserver32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{218D2740-5A50-42A8-AB9F-62FF1B168782}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.3.21.69\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.2.183.39\goopdate.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{320F0FDB-BE0A-4648-9D18-4A2C3448C007}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.3.21.79\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{326787D9-37B9-47A6-B539-EE13E7B04B8B}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\devicemanagerproperties.dll (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{47F64EC4-1AD6-4168-9D4C-00F3842F7CFB}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\DeviceManagerProperties.dll (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{4B66DD3F-2E6E-4F7C-B38C-E32608820825}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.3.21.145\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.3.21.123\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{73D320C0-FACA-4553-9D5F-070F9E4DC5C8}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\DeviceManagerProperties.dll (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{82D1C283-A637-4A07-B1EC-8C7AE661EAF1}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\devicemanagerproperties.dll (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{AD046C04-9CC6-4424-A8E2-1F8BB9D0B29D}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManagerps.dll (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{BA3D0120-E617-4F66-ADCA-585CC2FB86DB}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{C8992C14-DF59-4518-808F-CCFBB5850282}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\devicemanagerproperties.dll (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{D41C1E5B-0566-4BB1-BE72-1A5407349CA6}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{DB25D157-76D4-41C1-97B5-359E4A4CECEB}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.3.21.65\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{EB59852D-B38E-4A4C-94BA-6731836E5538}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\DeviceManagerProperties.dll (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{EE7F6B66-AC97-41CF-BD88-372DDB786DB6}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{F6CF0104-4F4A-4EBE-999D-A12D838E65B5}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgrPs.dll (Research In Motion Limited)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1425939879-190374836-1102705582-1000_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File

==================== Restore Points  =========================

13-08-2014 13:51:27 Scheduled Checkpoint
15-08-2014 18:36:30 Windows Update
06-09-2014 13:10:57 Scheduled Checkpoint
20-11-2014 17:58:24 Windows Update
09-01-2015 15:26:16 Windows Update
11-01-2015 20:19:52 Windows Update
14-01-2015 11:08:04 Windows Update
15-01-2015 19:50:49 Windows Update
16-01-2015 15:49:29 Windows Update
17-01-2015 12:34:05 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {125AECBC-2443-4CDB-807C-204F5B244724} - System32\Tasks\D8WL83L1\Administrator - Start WLAN Tray Applet => C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE [2009-07-17] (Dell Inc.)
Task: {5AF988EF-CF91-4F34-B8F5-A4478B5B8A93} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {65B32A54-8274-4D09-B3D1-FBD373F47E8F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-03] (Adobe Systems Incorporated)
Task: {6AF5C51C-6829-461E-8228-B30C4854EEC1} - System32\Tasks\{6344C155-97D9-4556-A018-C7A227FA5072} => c:\program files\opera\opera.exe [2012-12-15] (Opera Software)
Task: {8529A15C-7384-4542-8740-708753876849} - System32\Tasks\{C7C5E26F-901B-41FF-AD9B-A4CEFE5167BE} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {85B4A81A-E21D-436D-A17E-BB18524B561C} - System32\Tasks\Opera scheduled Autoupdate 1420733669 => C:\Program Files\Opera\launcher.exe [2015-01-23] (Opera Software)
Task: {AC283CE0-B98E-4592-B050-57EAD8FFE347} - System32\Tasks\{6D9BEE75-62AE-4389-9EE9-E6535EB5F302} => Chrome.exe 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2009-11-20 11:26 - 2009-07-17 02:06 - 00026112 _____ () C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
2009-11-20 11:26 - 2009-07-17 02:06 - 00055808 _____ () C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlrmt.dll
2011-03-14 16:27 - 2011-03-14 16:27 - 00271712 ____C () C:\ProgramData\DatacardService\HWDeviceService.exe
2012-11-23 10:46 - 2013-02-15 23:54 - 00246112 ____C () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
2012-11-23 10:46 - 2012-11-23 10:44 - 00011362 ____C () C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll
2012-11-23 10:46 - 2012-11-23 10:44 - 00043008 ____C () C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll
2012-11-23 10:46 - 2012-11-23 10:44 - 02415104 ____C () C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll
2012-11-23 10:46 - 2012-11-23 10:44 - 01148416 ____C () C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll
2012-11-23 10:46 - 2012-11-23 10:44 - 00384512 ____C () C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll
2012-11-23 10:46 - 2012-11-23 10:44 - 00398336 ____C () C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll
2014-05-31 17:09 - 2012-01-17 17:49 - 00270672 ____C () C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
2009-07-07 17:23 - 2009-07-07 17:23 - 00017648 _____ () C:\Program Files\Dell DataSafe Online\cpputils.dll
2009-06-26 22:43 - 2009-06-26 22:43 - 00577536 _____ () C:\Windows\system32\EMSC.dll
2009-07-07 17:23 - 2009-07-07 17:23 - 01779952 _____ () C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
2009-07-07 17:24 - 2009-07-07 17:24 - 00268528 _____ () C:\Program Files\Dell DataSafe Online\SdbShared.dll
2009-07-07 17:23 - 2009-07-07 17:23 - 00058608 _____ () C:\Program Files\Dell DataSafe Online\BalloonWindow.dll
2009-07-07 17:24 - 2009-07-07 17:24 - 00095472 _____ () C:\Program Files\Dell DataSafe Online\SdbUI.dll
2009-07-07 17:24 - 2009-07-07 17:24 - 00140528 _____ () C:\Program Files\Dell DataSafe Online\SdbShared.XmlSerializers.dll
2015-01-27 17:16 - 2015-01-27 17:16 - 00552056 ____C () C:\Program Files\Opera\27.0.1689.54\opera_crashreporter.exe
2015-01-27 17:16 - 2015-01-27 17:15 - 01408632 ____C () C:\Program Files\Opera\27.0.1689.54\libglesv2.dll
2015-01-27 17:16 - 2015-01-27 17:15 - 00219256 ____C () C:\Program Files\Opera\27.0.1689.54\libegl.dll
2015-01-27 17:16 - 2015-01-27 17:16 - 09510520 ____C () C:\Program Files\Opera\27.0.1689.54\pdf.dll
2015-01-25 18:52 - 2015-01-25 18:52 - 16844976 ____C () C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_296.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\user\Desktop\Es fällt mir sehr schwer.docx:com.dropbox.attributes

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^user^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^user^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupreg: Broadcom Wireless Manager UI => C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: MediaGet2 => C:\Users\user\AppData\Local\MediaGet2\mediaget.exe --minimized
MSCONFIG\startupreg: mobilegeni daemon => C:\Program Files\Mobogenie\DaemonProcess.exe
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: RIMBBLaunchAgent.exe => C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: UIExec => "C:\Program Files\1&1 Surf-Stick\UIExec.exe"
MSCONFIG\startupreg: WSED => C:\Program Files\WSED\WSED.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-1425939879-190374836-1102705582-500 - Administrator - Disabled)
Guest (S-1-5-21-1425939879-190374836-1102705582-501 - Limited - Disabled)
user (S-1-5-21-1425939879-190374836-1102705582-1000 - Administrator - Enabled) => C:\Users\user

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/03/2015 08:51:08 AM) (Source: Swapdrive Backup) (EventID: 0) (User: )
Description: Swapdrive Backup: Web Service Error: System.Net.WebException: The remote name could not be resolved: 'wsvcdell.backup.com'
   at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context)
   at System.Net.HttpWebRequest.GetRequestStream()
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Swapdrive.Shared.com.backup.uswsvcdell.Service.GetInfo(GetInfoRequest req)
   at Swapdrive.Shared.ActivationWsvcs.GetInfo()

Error: (02/02/2015 04:15:16 AM) (Source: Swapdrive Backup) (EventID: 0) (User: )
Description: Swapdrive Backup: Web Service Error: System.Net.WebException: The remote name could not be resolved: 'wsvcdell.backup.com'
   at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context)
   at System.Net.HttpWebRequest.GetRequestStream()
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Swapdrive.Shared.com.backup.uswsvcdell.Service.GetInfo(GetInfoRequest req)
   at Swapdrive.Shared.ActivationWsvcs.GetInfo()

Error: (01/30/2015 06:12:14 PM) (Source: Swapdrive Backup) (EventID: 0) (User: )
Description: Swapdrive Backup: Web Service Error: System.Net.WebException: The remote name could not be resolved: 'wsvcdell.backup.com'
   at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context)
   at System.Net.HttpWebRequest.GetRequestStream()
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Swapdrive.Shared.com.backup.uswsvcdell.Service.GetInfo(GetInfoRequest req)
   at Swapdrive.Shared.ActivationWsvcs.GetInfo()

Error: (01/30/2015 06:10:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: bcmwltry.exe, version: 5.30.21.0, time stamp: 0x4a53eb2a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x03748ccc
Faulting process id: 0x608
Faulting application start time: 0xbcmwltry.exe0
Faulting application path: bcmwltry.exe1
Faulting module path: bcmwltry.exe2
Report Id: bcmwltry.exe3

Error: (01/29/2015 10:43:47 AM) (Source: Swapdrive Backup) (EventID: 0) (User: )
Description: Swapdrive Backup: Web Service Error: System.Net.WebException: The remote name could not be resolved: 'wsvcdell.backup.com'
   at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context)
   at System.Net.HttpWebRequest.GetRequestStream()
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Swapdrive.Shared.com.backup.uswsvcdell.Service.GetInfo(GetInfoRequest req)
   at Swapdrive.Shared.ActivationWsvcs.GetInfo()

Error: (01/26/2015 10:34:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: bcmwltry.exe, version: 5.30.21.0, time stamp: 0x4a53eb2a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x03a688ac
Faulting process id: 0x5c4
Faulting application start time: 0xbcmwltry.exe0
Faulting application path: bcmwltry.exe1
Faulting module path: bcmwltry.exe2
Report Id: bcmwltry.exe3

Error: (01/25/2015 05:02:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: bcmwltry.exe, version: 5.30.21.0, time stamp: 0x4a53eb2a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x03658fac
Faulting process id: 0x5d4
Faulting application start time: 0xbcmwltry.exe0
Faulting application path: bcmwltry.exe1
Faulting module path: bcmwltry.exe2
Report Id: bcmwltry.exe3

Error: (01/24/2015 11:27:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: opera.exe, version: 26.0.1656.60, time stamp: 0x54903b64
Faulting module name: opera.exe, version: 26.0.1656.60, time stamp: 0x54903b64
Exception code: 0x80000003
Fault offset: 0x00086280
Faulting process id: 0x1100
Faulting application start time: 0xopera.exe0
Faulting application path: opera.exe1
Faulting module path: opera.exe2
Report Id: opera.exe3

Error: (01/24/2015 10:39:02 PM) (Source: Swapdrive Backup) (EventID: 0) (User: )
Description: Swapdrive Backup: Web Service Error: System.Net.WebException: The remote name could not be resolved: 'wsvcdell.backup.com'
   at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context)
   at System.Net.HttpWebRequest.GetRequestStream()
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Swapdrive.Shared.com.backup.uswsvcdell.Service.GetInfo(GetInfoRequest req)
   at Swapdrive.Shared.ActivationWsvcs.GetInfo()

Error: (01/24/2015 00:23:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: bcmwltry.exe, version: 5.30.21.0, time stamp: 0x4a53eb2a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x036588ac
Faulting process id: 0x5b4
Faulting application start time: 0xbcmwltry.exe0
Faulting application path: bcmwltry.exe1
Faulting module path: bcmwltry.exe2
Report Id: bcmwltry.exe3


System errors:
=============
Error: (02/03/2015 08:48:54 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load: 
cdrom

Error: (02/03/2015 08:47:37 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Mobile Partner. OUC service failed to start due to the following error: 
%%1053

Error: (02/03/2015 08:47:37 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Mobile Partner. OUC service to connect.

Error: (02/02/2015 05:26:50 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (02/02/2015 04:12:53 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load: 
cdrom

Error: (02/02/2015 04:11:18 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Mobile Partner. OUC service failed to start due to the following error: 
%%1053

Error: (02/02/2015 04:11:18 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Mobile Partner. OUC service to connect.

Error: (01/31/2015 01:37:04 PM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer O2BOX
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{D3AAA2D7-6FBE-4F4A-94A8-21AC44E5A291.
The master browser is stopping or an election is being forced.

Error: (01/31/2015 01:07:03 PM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer O2BOX
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{D3AAA2D7-6FBE-4F4A-94A8-21AC44E5A291.
The master browser is stopping or an election is being forced.

Error: (01/31/2015 00:29:02 PM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer O2BOX
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{D3AAA2D7-6FBE-4F4A-94A8-21AC44E5A291.
The master browser is stopping or an election is being forced.


Microsoft Office Sessions:
=========================
Error: (10/29/2010 01:20:38 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 157 seconds with 120 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Processor: Intel(R) Atom(TM) CPU N280 @ 1.66GHz
Percentage of memory in use: 79%
Total physical RAM: 1014.43 MB
Available physical RAM: 207.93 MB
Total Pagefile: 2038.43 MB
Available Pagefile: 644 MB
Total Virtual: 2047.88 MB
Available Virtual: 1906.33 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:218.2 GB) (Free:130.16 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: BAAC612B)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=14.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=218.2 GB) - (Type=07 NTFS)

==================== End Of Log ============================

--- --- ---

schrauber · 06.02.2015, 07:24

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

blessy · 06.02.2015, 18:56

Combofix Logfile:

Code:

ATTFilter

ComboFix 15-02-02.01 - user 06.02.2015  18:01:25.1.2 - x86
Microsoft Windows 7 Starter   6.1.7601.1.1252.49.1033.18.1014.332 [GMT 1:00]
ausgeführt von:: c:\users\user\Desktop\New folder\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\user\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-01-06 bis 2015-02-06  ))))))))))))))))))))))))))))))
.
.
2015-02-06 17:24 . 2015-02-06 17:30	--------	dc----w-	c:\users\user\AppData\Local\temp
2015-02-06 17:24 . 2015-02-06 17:24	--------	dc----w-	c:\users\Default\AppData\Local\temp
2015-02-03 17:31 . 2015-02-03 17:53	--------	dc----w-	C:\FRST
2015-01-27 18:43 . 2015-01-27 18:44	--------	dc----w-	c:\program files\StreamTransport
2015-01-15 17:39 . 2015-01-16 14:52	115712	----a-w-	c:\windows\system32\ieUnatt.exe
2015-01-15 17:39 . 2015-01-16 14:52	3971512	----a-w-	c:\windows\system32\ntkrnlpa.exe
2015-01-15 17:39 . 2015-01-16 14:52	3916728	----a-w-	c:\windows\system32\ntoskrnl.exe
2015-01-15 17:38 . 2015-01-16 14:51	164864	----a-w-	c:\windows\system32\profsvc.dll
2015-01-15 17:38 . 2015-01-17 11:41	116224	----a-w-	c:\windows\system32\drivers\mrxdav.sys
2015-01-15 17:38 . 2015-01-16 14:51	242688	----a-w-	c:\windows\system32\nlasvc.dll
2015-01-15 17:13 . 2015-01-15 17:13	--------	dcsh--w-	c:\users\user\AppData\Local\EmieUserList
2015-01-15 17:13 . 2015-01-15 17:13	--------	dcsh--w-	c:\users\user\AppData\Local\EmieBrowserModeList
2015-01-15 17:13 . 2015-01-15 17:13	--------	dcsh--w-	c:\users\user\AppData\Local\EmieSiteList
2015-01-14 11:17 . 2015-01-14 11:17	--------	dc----w-	c:\windows\system32\appraiser
2015-01-14 10:46 . 2015-01-14 10:47	23040	----a-w-	c:\windows\system32\mfpmp.exe
2015-01-14 10:46 . 2015-01-14 10:47	2048	----a-w-	c:\windows\system32\mferror.dll
2015-01-11 18:42 . 2015-01-14 10:45	305152	----a-w-	c:\windows\system32\gdi32.dll
2015-01-11 18:42 . 2015-01-14 10:44	1237504	----a-w-	c:\windows\system32\msxml3.dll
2015-01-11 18:42 . 2015-01-14 10:44	2048	----a-w-	c:\windows\system32\msxml3r.dll
2015-01-11 18:40 . 2015-01-14 10:36	468992	----a-w-	c:\program files\Internet Explorer\ieinstal.exe
2015-01-11 18:40 . 2015-01-14 10:36	2052096	----a-w-	c:\windows\system32\inetcpl.cpl
2015-01-11 18:40 . 2015-01-14 10:36	62464	----a-w-	c:\windows\system32\iesetup.dll
2015-01-11 18:40 . 2015-01-14 10:36	10948096	----a-w-	c:\program files\Internet Explorer\F12Resources.dll
2015-01-11 18:40 . 2015-01-14 10:36	815280	----a-w-	c:\program files\Internet Explorer\iexplore.exe
2015-01-11 18:40 . 2015-01-14 10:38	248832	----a-w-	c:\windows\system32\schannel.dll
2015-01-11 18:40 . 2015-01-14 10:38	259584	----a-w-	c:\windows\system32\msv1_0.dll
2015-01-11 18:40 . 2015-01-14 10:38	221184	----a-w-	c:\windows\system32\ncrypt.dll
2015-01-11 18:40 . 2015-01-14 10:38	17408	----a-w-	c:\windows\system32\credssp.dll
2015-01-11 18:39 . 2015-01-14 10:09	1131664	----a-w-	c:\windows\system32\dfshim.dll
2015-01-11 18:39 . 2015-01-14 10:09	156824	----a-w-	c:\windows\system32\mscorier.dll
2015-01-11 18:39 . 2015-01-14 10:09	81560	----a-w-	c:\windows\system32\mscories.dll
2015-01-11 18:39 . 2015-01-14 10:24	1987584	----a-w-	c:\windows\system32\d3d10warp.dll
2015-01-11 18:38 . 2015-01-11 20:08	67584	----a-w-	c:\windows\system32\packager.dll
2015-01-11 18:38 . 2015-01-11 20:08	2744320	----a-w-	c:\windows\system32\rdpcorets.dll
2015-01-11 18:35 . 2015-01-11 19:47	155136	----a-w-	c:\windows\system32\charmap.exe
2015-01-11 18:35 . 2015-01-11 19:46	5703168	----a-w-	c:\windows\system32\mstscax.dll
2015-01-11 18:16 . 2015-01-11 19:44	130048	----a-w-	c:\windows\system32\rdpcorekmts.dll
2015-01-11 18:16 . 2015-01-11 19:44	184320	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2015-01-11 18:16 . 2015-01-11 19:44	31232	----a-w-	c:\windows\system32\drivers\tssecsrv.sys
2015-01-11 18:13 . 2015-01-14 10:57	654336	----a-w-	c:\windows\system32\rpcrt4.dll
2015-01-11 18:11 . 2015-01-14 10:49	730048	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2015-01-11 18:11 . 2015-01-14 10:49	219072	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2015-01-11 18:11 . 2015-01-14 10:49	107520	----a-w-	c:\windows\system32\cdd.dll
2015-01-11 17:53 . 2015-01-11 19:25	1059840	----a-w-	c:\windows\system32\lsasrv.dll
2015-01-11 17:53 . 2015-01-11 19:25	681984	----a-w-	c:\windows\system32\adtschema.dll
2015-01-11 17:53 . 2015-01-11 19:25	146432	----a-w-	c:\windows\system32\msaudite.dll
2015-01-11 17:53 . 2015-01-11 19:25	136632	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2015-01-11 17:52 . 2015-01-14 10:24	1805824	----a-w-	c:\windows\system32\authui.dll
2015-01-11 17:52 . 2015-01-14 10:24	101824	----a-w-	c:\windows\system32\consent.exe
2015-01-11 17:52 . 2015-01-14 10:24	337408	----a-w-	c:\windows\system32\msihnd.dll
2015-01-09 16:10 . 2015-01-27 17:23	--------	dc----r-	c:\users\user\Dropbox
2015-01-09 15:55 . 2015-01-27 15:31	--------	dc----w-	c:\users\user\AppData\Roaming\Dropbox
2015-01-09 15:01 . 2015-01-09 15:01	20080	-c--a-w-	c:\program files\Mozilla Firefox\AccessibleMarshal.dll
2015-01-09 15:01 . 2015-01-09 15:01	2106216	-c--a-w-	c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2015-01-09 15:01 . 2015-01-09 15:01	74864	-c--a-w-	c:\program files\Mozilla Firefox\breakpadinjector.dll
2015-01-09 15:01 . 2015-01-09 15:01	48240	-c--a-w-	c:\program files\Mozilla Firefox\browser\components\browsercomps.dll
2015-01-09 15:01 . 2015-01-09 15:01	260208	-c--a-w-	c:\program files\Mozilla Firefox\crashreporter.exe
2015-01-08 16:15 . 2015-01-08 16:15	--------	dc----w-	c:\users\user\AppData\Local\Opera Software
2015-01-08 16:15 . 2015-01-08 16:15	--------	dc----w-	c:\users\user\AppData\Roaming\Opera Software
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-05 17:50 . 2012-10-13 19:31	701616	-c--a-w-	c:\windows\system32\FlashPlayerApp.exe
2015-02-05 17:50 . 2011-07-16 19:44	71344	-c--a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2015-01-16 14:51 . 2015-01-15 17:38	74240	----a-w-	c:\windows\system32\TSWbPrxy.exe
2015-01-14 10:58 . 2015-01-11 18:43	1230336	----a-w-	c:\windows\system32\WindowsCodecs.dll
2015-01-14 10:38 . 2015-01-11 18:40	2379264	----a-w-	c:\windows\system32\win32k.sys
2015-01-14 10:38 . 2015-01-11 18:40	172032	----a-w-	c:\windows\system32\wdigest.dll
2015-01-14 10:38 . 2015-01-11 18:40	65536	----a-w-	c:\windows\system32\TSpkg.dll
2015-01-14 10:36 . 2015-01-11 18:41	501248	----a-w-	c:\windows\system32\vbscript.dll
2015-01-14 10:36 . 2015-01-11 18:41	1888256	----a-w-	c:\windows\system32\wininet.dll
2015-01-14 10:34 . 2015-01-11 18:39	2048	----a-w-	c:\windows\system32\tzres.dll
2015-01-14 10:23 . 2015-01-11 18:45	793600	----a-w-	c:\windows\system32\TSWorkspace.dll
2015-01-14 10:22 . 2015-01-14 10:15	35480	----a-w-	c:\windows\system32\TsWpfWrp.exe
2015-01-11 19:44 . 2015-01-11 18:16	157696	----a-w-	c:\windows\system32\winsta.dll
2015-01-11 19:44 . 2015-01-11 18:16	304128	----a-w-	c:\windows\system32\winlogon.exe
2015-01-11 19:25 . 2015-01-11 17:53	523776	----a-w-	c:\windows\system32\termsrv.dll
2015-01-11 19:20 . 2015-01-11 17:52	1177088	----a-w-	c:\windows\system32\WsmSvc.dll
2015-01-11 19:20 . 2015-01-11 17:52	248832	----a-w-	c:\windows\system32\WSManMigrationPlugin.dll
2015-01-11 19:20 . 2015-01-11 17:52	198656	----a-w-	c:\windows\system32\WSManHTTPConfig.exe
2015-01-11 19:20 . 2015-01-11 17:52	145920	----a-w-	c:\windows\system32\WsmAuto.dll
2015-01-11 19:20 . 2015-01-11 17:52	214016	----a-w-	c:\windows\system32\WsmWmiPl.dll
2015-01-09 14:56 . 2010-06-24 09:33	23256	-c--a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2015-01-09 14:49 . 2015-01-09 14:28	36320	----a-w-	c:\windows\system32\wups.dll
2015-01-09 14:49 . 2015-01-09 14:28	92672	----a-w-	c:\windows\system32\wudriver.dll
2015-01-09 14:49 . 2015-01-09 14:28	581600	----a-w-	c:\windows\system32\wuapi.dll
2015-01-09 14:30 . 2015-01-09 14:27	179656	----a-w-	c:\windows\system32\wuwebv.dll
2015-01-09 14:30 . 2015-01-09 14:27	33792	----a-w-	c:\windows\system32\wuapp.exe
2015-01-09 14:30 . 2015-01-09 14:29	54240	----a-w-	c:\windows\system32\wuauclt.exe
2015-01-09 14:30 . 2015-01-09 14:29	45536	----a-w-	c:\windows\system32\wups2.dll
2015-01-09 14:30 . 2015-01-09 14:29	2425856	----a-w-	c:\windows\system32\wucltux.dll
2015-01-09 14:30 . 2015-01-09 14:29	1973728	----a-w-	c:\windows\system32\wuaueng.dll
2015-01-08 15:11 . 2014-08-14 17:18	37384	-c--a-w-	c:\windows\system32\drivers\avnetflt.sys
2015-01-08 15:10 . 2014-08-06 11:25	136216	-c--a-w-	c:\windows\system32\drivers\avipbb.sys
2015-01-08 15:10 . 2014-08-06 11:25	98160	-c--a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-11-18 13:56 . 2014-11-18 13:56	1202848	-c--a-w-	c:\windows\system32\FM20.DLL
2013-08-24 19:43 . 2013-08-24 19:43	4188160	-c--a-w-	c:\program files\GUT2433.tmp
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-06-16 7547424]
"BTMeter"="c:\program files\Battery Meter\BTMeter.exe" [2009-07-22 623984]
"CapsLKNotify"="c:\program files\CapsLKNotify\CapsLKNotify.exe" [2009-06-09 320880]
"Dell DataSafe Online"="c:\program files\Dell DataSafe Online\DataSafeOnline.exe" [2009-07-07 1779952]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2015-01-08 702768]
"Avira Systray"="c:\program files\Avira\My Avira\Avira.OE.Systray.exe" [2014-12-31 126712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^user^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^user^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2009-07-17 01:06	4562944	----a-w-	c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-09-23 11:30	173592	-c--a-w-	c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaGet2]
2015-01-23 08:29	13501416	-c--a-w-	c:\users\user\AppData\Local\MediaGet2\mediaget.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-23 11:30	150552	-c--a-w-	c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RIMBBLaunchAgent.exe]
2013-01-17 14:08	267792	-c--a-w-	c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-05-29 10:53	1529128	----a-w-	c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UIExec]
2012-01-17 16:49	153424	-c--a-w-	c:\program files\1&1 Surf-Stick\UIExec.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WSED]
2009-05-27 21:24	247080	----a-w-	c:\program files\WSED\WSED.exe
.
R2 Mobile Partner. RunOuc;Mobile Partner. OUC;c:\program files\Mobile Partner\UpdateDog\ouc.exe [2013-02-15 246112]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-10-23 172192]
R3 AVerFx2hbtv;AVerMedia USB SW Hybrid Tuner;c:\windows\system32\drivers\AVerFx2hbtv.sys [2009-07-13 253824]
R3 Blackberry Device Manager;Blackberry Device Manager;c:\program files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [2013-01-18 577536]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-14 45736]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2013-02-15 102784]
R3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\DRIVERS\ewusbwwan.sys [2013-02-15 353280]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-01-14 102912]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2011-03-26 9216]
R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2014-05-09 14848]
R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys [2011-03-14 31848]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-06-24 167424]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2014-05-09 49152]
R3 usbrndis6;USB RNDIS6 Adapter;c:\windows\system32\DRIVERS\usb80236.sys [2013-02-12 15872]
S0 EMSC;COMPAL Embedded System Control;c:\windows\system32\DRIVERS\EMSC.SYS [2009-06-26 13680]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2014-07-23 37352]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSrv.exe [2009-03-31 81920]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2015-01-08 431920]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files\Avira\My Avira\Avira.OE.ServiceHost.exe [2014-12-31 178424]
S2 HWDeviceService.exe;HWDeviceService.exe;c:\programdata\DatacardService\HWDeviceService.exe [2011-03-14 271712]
S2 UI Assistant Service;UI Assistant Service;c:\program files\1&1 Surf-Stick\AssistantServices.exe [2012-01-17 270672]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-03-12 143840]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2013-02-15 73216]
S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys [2011-03-14 31848]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc
getPlusHelper	REG_MULTI_SZ   	getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2015-02-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-13 17:51]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.mysearchdial.com/?f=1&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
mStart Page = hxxp://start.mysearchdial.com/?f=1&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
IE: Free YouTube to MP3 Converter - c:\users\user\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{08650572-AE47-4832-8BDE-956C2964F5A3}: NameServer = 212.23.115.148 212.23.115.150
TCP: Interfaces\{7B4B1029-983A-4AA6-BF81-6C41A7CFACF4}: NameServer = 212.23.115.150 212.23.115.84
TCP: Interfaces\{D7E13746-1E44-4176-8C66-3FEF74D3DFE5}: NameServer = 212.23.115.148 212.23.115.132
FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - 
FF - user.js: extensions.mysearchdial.hmpg - true
FF - user.js: extensions.mysearchdial.hmpgUrl - hxxp://start.mysearchdial.com/?f=1&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
FF - user.js: extensions.mysearchdial.dfltSrch - true
FF - user.js: extensions.mysearchdial.srchPrvdr - Mysearchdial
FF - user.js: extensions.mysearchdial.dnsErr - true
FF - user.js: extensions.mysearchdial_i.newTab - false
FF - user.js: extensions.mysearchdial.newTabUrl - hxxp://start.mysearchdial.com/?f=2&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
FF - user.js: extensions.mysearchdial.tlbrSrchUrl - hxxp://start.mysearchdial.com/?f=3&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=&q=
FF - user.js: extensions.mysearchdial.id - 904CE5296B7E4335
FF - user.js: extensions.mysearchdial.instlDay - 16059
FF - user.js: extensions.mysearchdial.vrsn - 1.8.21.0
FF - user.js: extensions.mysearchdial.vrsni - 1.8.21.0
FF - user.js: extensions.mysearchdial_i.vrsnTs - 1.8.21.012:49
FF - user.js: extensions.mysearchdial.prtnrId - mysearchdial
FF - user.js: extensions.mysearchdial.prdct - mysearchdial
FF - user.js: extensions.mysearchdial.aflt - irmsd1202
FF - user.js: extensions.mysearchdial_i.smplGrp - none
FF - user.js: extensions.mysearchdial.tlbrId - base
FF - user.js: extensions.mysearchdial.instlRef - 
FF - user.js: extensions.mysearchdial.dfltLng - 
FF - user.js: extensions.mysearchdial.appId - {CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}
FF - user.js: extensions.mysearchdial.excTlbr - false
FF - user.js: extensions.mysearchdial_i.hmpg - true
FF - user.js: extensions.mysearchdial.cr - 63991871
FF - user.js: extensions.mysearchdial.cd - 2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R
FF - user.js: extensions.irmysearch.aflt - irmsd1202
FF - user.js: extensions.irmysearch.instlRef - 
FF - user.js: extensions.irmysearch.cr - 63991871
FF - user.js: extensions.irmysearch.cd - 2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{872b5b88-9db5-4310-bdd0-ac189557e5f5} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
WebBrowser-{41564952-412D-5637-00A7-7A786E7484D7} - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
MSConfigStartUp-mobilegeni daemon - c:\program files\Mobogenie\DaemonProcess.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
c:\program files\Dell\Dell Wireless WLAN Card\bcmwltry.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\programdata\Mobile Partner\OnlineUpdate\ouc.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-02-06  18:42:09 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2015-02-06 17:42
.
Vor Suchlauf: 139.122.094.080 bytes free
Nach Suchlauf: 143.178.280.960 bytes free
.
- - End Of File - - 7701EFA6605D92D7748EB2628DBBC7D2

--- --- ---
5C616939100B85E558DA92B899A0FC36

schrauber · 07.02.2015, 12:02

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

blessy · 07.02.2015, 18:29

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-02-2015
Ran by user (administrator) on USER-PC on 07-02-2015 18:10:13
Running from C:\Users\user\Desktop\New folder
Loaded Profiles: user (Available profiles: user)
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\BCMWLTRY.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSrv.exe
() C:\ProgramData\DatacardService\HWDeviceService.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
() C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Dell) C:\Program Files\Battery Meter\BTMeter.exe
(Compal Electronics, Inc) C:\Program Files\CapsLKNotify\CapsLKNotify.exe
() C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtcmd.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtsvc.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7547424 2009-06-16] (Realtek Semiconductor)
HKLM\...\Run: [BTMeter] => C:\Program Files\Battery Meter\BTMeter.exe [623984 2009-07-22] (Dell)
HKLM\...\Run: [CapsLKNotify] => C:\Program Files\CapsLKNotify\CapsLKNotify.exe [320880 2009-06-10] (Compal Electronics, Inc)
HKLM\...\Run: [Dell DataSafe Online] => C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe [1779952 2009-07-07] ()
HKLM\...\Run: [dellsupportcenter] => C:\Program Files\Dell Support Center\bin\sprtcmd.exe [206064 2009-06-03] (SupportSoft, Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2015-01-08] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126712 2014-12-31] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {32dabb42-1886-11df-a82d-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {35602fa2-3550-11e2-a74d-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {35602fc7-3550-11e2-a74d-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {4757b95a-a385-11e3-83f0-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {5340d7e2-77c1-11e2-9d8e-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {5340d7f7-77c1-11e2-9d8e-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {5f59a581-fe5f-11de-9b42-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {5f59a59b-fe5f-11de-9b42-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {780be736-ff86-11de-ae2b-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {8b8cad91-cef2-11df-95d4-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {8b8cadc5-cef2-11df-95d4-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {a36f5ff3-8937-11df-af67-806e6f6e6963} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {b5cd9526-0cf6-11e0-8264-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {be2c2944-3718-11e2-a674-001e101f8aaa} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {d6c5e785-cd61-11df-9550-0c6076ff0764} - D:\AutoRun.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Mysearchdial Search
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\Software\Microsoft\Internet Explorer\Main,Start Page = Mysearchdial Search
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Dell - The Official Site | Dell Malaysia
URLSearchHook: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} -  No File
SearchScopes: HKLM -> DefaultScope {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKLM -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> DefaultScope {3ADA25D8-6B8E-4174-99B0-0340EBF9F87F} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=VIATDF&PC=VIATDF&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {3ADA25D8-6B8E-4174-99B0-0340EBF9F87F} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80196&lng=de
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {E1FB93A2-C203-4F7F-AD9B-8F1199E23FA5} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=kw&q={searchTerms}&locale=&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=b746bf59-8f6b-41c6-bd8f-56cdb4ce0ab3&apn_sauid=98616C0B-6F63-4D56-9456-89E6F03B5759
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File
Toolbar: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> No Name - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} -  No File
Toolbar: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{08650572-AE47-4832-8BDE-956C2964F5A3}: [NameServer] 212.23.115.148 212.23.115.150
Tcpip\..\Interfaces\{7B4B1029-983A-4AA6-BF81-6C41A7CFACF4}: [NameServer] 212.23.115.150 212.23.115.84
Tcpip\..\Interfaces\{D7E13746-1E44-4176-8C66-3FEF74D3DFE5}: [NameServer] 212.23.115.148 212.23.115.132

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default
FF SearchEngineOrder.1: Mysearchdial
FF Homepage: about:home
FF Keyword.URL: 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\searchplugins\Mysearchdial.xml
FF Extension: DownloadHelper - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-01-25]
FF Extension: 1-Click YouTube Video Downloader - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2015-01-25]
FF Extension: MySearchDial - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\Extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi [2014-07-30]

Chrome: 
=======
CHR HomePage: Default -> hxxp://start.mysearchdial.com/?f=1&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR DefaultSearchKeyword: Default -> mysearchdial.com
CHR DefaultSearchURL: Default -> hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-20]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-20]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-06]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-20]
CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-20]
CHR Extension: (Avira Browser Safety) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-08-06]
CHR Extension: (Google Wallet) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-20]
CHR Extension: (MySearchDial) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff [2014-04-24]
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-20]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\user\AppData\Local\mysearchdial-speeddial.crx [2013-12-20]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2015-01-08] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2015-01-08] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [178424 2014-12-31] (Avira Operations GmbH & Co. KG)
S3 Blackberry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited) [File not signed]
S3 getPlusHelper; C:\Program Files\NOS\bin\getPlus_Helper.dll [51384 2009-12-01] (NOS Microsystems Ltd.)
R2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] ()
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S2 Mobile Partner. RunOuc; C:\Program Files\Mobile Partner\UpdateDog\ouc.exe [246112 2013-02-15] ()
R2 sprtsvc_DellSupportCenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968 2009-06-03] (SupportSoft, Inc.)
R2 UI Assistant Service; C:\Program Files\1&1 Surf-Stick\AssistantServices.exe [270672 2012-01-17] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-08-27] (Microsoft Corporation)
R2 wltrysvc; C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe [3086848 2009-07-17] (Dell Inc.) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AVerFx2hbtv; C:\Windows\System32\drivers\AVerFx2hbtv.sys [253824 2009-07-13] (AVerMedia TECHNOLOGIES, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2015-01-08] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-01-08] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-07-23] (Avira Operations GmbH & Co. KG)
R3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2009-07-17] (Broadcom Corporation)
R0 EMSC; C:\Windows\System32\DRIVERS\EMSC.SYS [13680 2009-06-26] (Windows (R) Win 7 DDK provider)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-03-26] (MBB Incorporated)
S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-13] (Ralink Technology Corp.)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2011-03-14] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2011-03-14] (RapidSolution Software AG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-07-23] (Avira GmbH)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 hwusbfake; system32\DRIVERS\ewusbfake.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-07 06:16 - 2015-02-07 06:54 - 00000000 ___DC () C:\Users\user\Desktop\tb 2015
2015-02-06 18:42 - 2015-02-06 18:42 - 00026380 ____C () C:\ComboFix.txt
2015-02-06 17:57 - 2011-06-26 07:45 - 00256000 ____C () C:\Windows\PEV.exe
2015-02-06 17:57 - 2010-11-07 18:20 - 00208896 ____C () C:\Windows\MBR.exe
2015-02-06 17:57 - 2009-04-20 05:56 - 00060416 ____C (NirSoft) C:\Windows\NIRCMD.exe
2015-02-06 17:57 - 2000-08-31 01:00 - 00518144 ____C (SteelWerX) C:\Windows\SWREG.exe
2015-02-06 17:57 - 2000-08-31 01:00 - 00406528 ____C (SteelWerX) C:\Windows\SWSC.exe
2015-02-06 17:57 - 2000-08-31 01:00 - 00098816 ____C () C:\Windows\sed.exe
2015-02-06 17:57 - 2000-08-31 01:00 - 00080412 ____C () C:\Windows\grep.exe
2015-02-06 17:57 - 2000-08-31 01:00 - 00068096 ____C () C:\Windows\zip.exe
2015-02-06 17:56 - 2015-02-07 14:17 - 00000000 __SDC () C:\ComboFix
2015-02-06 17:49 - 2015-02-06 18:42 - 00000000 ___DC () C:\Qoobox
2015-02-06 17:47 - 2015-02-07 14:17 - 00000000 __SDC () C:\32788R22FWJFW
2015-02-06 17:47 - 2015-02-06 17:47 - 00000000 ___DC () C:\Windows\erdnt
2015-02-05 18:02 - 2015-02-05 18:02 - 00001057 ____C () C:\Users\Public\Desktop\Avira.lnk
2015-02-03 18:31 - 2015-02-07 18:10 - 00000000 ___DC () C:\FRST
2015-01-27 19:44 - 2015-01-27 19:44 - 00001011 ____C () C:\Users\Public\Desktop\StreamTransport.lnk
2015-01-27 19:44 - 2015-01-27 19:44 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StreamTransport
2015-01-27 19:43 - 2015-01-27 19:44 - 00000000 ___DC () C:\Program Files\StreamTransport
2015-01-27 19:41 - 2015-01-27 19:41 - 17805707 ____C () C:\Users\user\Desktop\streamtransport_1.1.6.2.zip
2015-01-27 18:49 - 2015-01-27 18:49 - 00000000 ___DC () C:\Windows\pss
2015-01-25 21:00 - 2015-01-25 21:00 - 07165512 ____C () C:\Users\user\Downloads\wordpress-4.1-de_DE.zip
2015-01-24 14:47 - 2015-01-24 14:47 - 00351744 ____C () C:\Windows\Minidump\012415-24804-01.dmp
2015-01-15 18:54 - 2015-02-07 18:10 - 00000000 ___DC () C:\Users\user\Desktop\New folder
2015-01-15 18:39 - 2015-01-16 15:52 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-01-15 18:39 - 2015-01-16 15:52 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-15 18:39 - 2015-01-16 15:52 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-01-15 18:38 - 2015-01-17 12:41 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-15 18:38 - 2015-01-16 15:51 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-15 18:38 - 2015-01-16 15:51 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-15 18:38 - 2015-01-16 15:51 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-15 18:13 - 2015-01-15 18:13 - 00000000 _SHDC () C:\Users\user\AppData\Local\EmieUserList
2015-01-15 18:13 - 2015-01-15 18:13 - 00000000 _SHDC () C:\Users\user\AppData\Local\EmieSiteList
2015-01-15 18:13 - 2015-01-15 18:13 - 00000000 _SHDC () C:\Users\user\AppData\Local\EmieBrowserModeList
2015-01-14 12:17 - 2015-01-14 12:17 - 00000000 ___DC () C:\Windows\system32\appraiser
2015-01-14 11:46 - 2015-01-14 11:47 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-01-14 11:46 - 2015-01-14 11:47 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-01-14 11:46 - 2015-01-14 11:47 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-01-14 11:46 - 2015-01-14 11:47 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-01-14 11:46 - 2015-01-14 11:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-01-14 11:35 - 2015-01-14 11:35 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-01-14 11:17 - 2015-01-14 11:22 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2015-01-14 11:16 - 2015-01-14 11:22 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2015-01-14 11:16 - 2015-01-14 11:22 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2015-01-14 11:15 - 2015-01-14 11:22 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2015-01-11 19:45 - 2015-01-14 11:23 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2015-01-11 19:43 - 2015-01-14 12:00 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-01-11 19:43 - 2015-01-14 11:58 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-01-11 19:43 - 2015-01-14 11:58 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-01-11 19:43 - 2015-01-14 11:56 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-01-11 19:43 - 2015-01-14 11:56 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2015-01-11 19:42 - 2015-01-14 11:48 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2015-01-11 19:42 - 2015-01-14 11:46 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-01-11 19:42 - 2015-01-14 11:45 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-01-11 19:42 - 2015-01-14 11:44 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-01-11 19:42 - 2015-01-14 11:44 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-01-11 19:41 - 2015-01-14 11:42 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-01-11 19:41 - 2015-01-14 11:41 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-01-11 19:41 - 2015-01-14 11:36 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-01-11 19:41 - 2015-01-14 11:36 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-01-11 19:41 - 2015-01-14 11:36 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-01-11 19:41 - 2015-01-14 11:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-01-11 19:41 - 2015-01-14 11:34 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-01-11 19:40 - 2015-01-14 11:38 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-01-11 19:40 - 2015-01-14 11:36 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-01-11 19:40 - 2015-01-14 11:36 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-01-11 19:40 - 2015-01-14 11:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-01-11 19:40 - 2015-01-14 11:36 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-01-11 19:39 - 2015-01-14 11:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-01-11 19:39 - 2015-01-14 11:24 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-01-11 19:39 - 2015-01-14 11:09 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2015-01-11 19:39 - 2015-01-14 11:09 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2015-01-11 19:39 - 2015-01-14 11:09 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2015-01-11 19:38 - 2015-01-11 21:08 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-01-11 19:38 - 2015-01-11 21:08 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2015-01-11 19:35 - 2015-01-11 20:47 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2015-01-11 19:35 - 2015-01-11 20:46 - 05703168 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-01-11 19:16 - 2015-01-11 20:44 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2015-01-11 19:16 - 2015-01-11 20:44 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2015-01-11 19:16 - 2015-01-11 20:44 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2015-01-11 19:16 - 2015-01-11 20:44 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2015-01-11 19:16 - 2015-01-11 20:44 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2015-01-11 19:13 - 2015-01-14 11:57 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-01-11 19:11 - 2015-01-14 11:49 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2015-01-11 19:11 - 2015-01-14 11:49 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2015-01-11 19:11 - 2015-01-14 11:49 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 00136632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-01-11 18:52 - 2015-01-14 11:24 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-01-11 18:52 - 2015-01-14 11:24 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-01-11 18:52 - 2015-01-14 11:24 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-01-11 18:52 - 2015-01-11 20:20 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2015-01-11 18:52 - 2015-01-11 20:20 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2015-01-11 18:52 - 2015-01-11 20:20 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2015-01-11 18:52 - 2015-01-11 20:20 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2015-01-11 18:52 - 2015-01-11 20:20 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2015-01-09 17:10 - 2015-01-27 18:23 - 00000000 __RDC () C:\Users\user\Dropbox
2015-01-09 17:10 - 2015-01-09 17:10 - 00001086 ____C () C:\Users\user\Desktop\Dropbox.lnk
2015-01-09 17:02 - 2015-01-09 17:02 - 00000000 ___DC () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-01-09 16:55 - 2015-01-27 16:31 - 00000000 ___DC () C:\Users\user\AppData\Roaming\Dropbox
2015-01-09 16:55 - 2015-01-09 16:55 - 00324112 ____C (Dropbox, Inc.) C:\Users\user\Downloads\DropboxInstaller.exe
2015-01-09 15:29 - 2015-01-09 15:30 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-01-09 15:29 - 2015-01-09 15:30 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-01-09 15:29 - 2015-01-09 15:30 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-01-09 15:29 - 2015-01-09 15:30 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-01-09 15:28 - 2015-01-09 15:49 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-01-09 15:28 - 2015-01-09 15:49 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-01-09 15:28 - 2015-01-09 15:49 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-01-09 15:27 - 2015-01-09 15:30 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-01-09 15:27 - 2015-01-09 15:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-01-08 17:15 - 2015-01-08 17:15 - 00335928 ____C () C:\Users\user\Desktop\Opera 12 Notes.html
2015-01-08 17:15 - 2015-01-08 17:15 - 00000000 ___DC () C:\Users\user\AppData\Roaming\Opera Software
2015-01-08 17:15 - 2015-01-08 17:15 - 00000000 ___DC () C:\Users\user\AppData\Local\Opera Software

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-07 18:05 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-07 18:05 - 2009-07-14 05:39 - 00220844 _____ () C:\Windows\setupact.log
2015-02-07 14:18 - 2009-07-14 03:37 - 00000000 ___DC () C:\Windows\system32\wfp
2015-02-07 14:17 - 2014-05-31 17:09 - 00000000 ___DC () C:\Program Files\1&1 Surf-Stick
2015-02-07 14:17 - 2010-12-13 20:29 - 00000000 ___DC () C:\Program Files\Mozilla Firefox
2015-02-07 14:17 - 2010-10-01 15:04 - 00000000 ___DC () C:\Program Files\Opera
2015-02-07 14:17 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration
2015-02-07 14:13 - 2009-07-14 03:37 - 00000000 _RHDC () C:\Users\Default
2015-02-07 06:58 - 2009-07-14 05:55 - 01799397 _____ () C:\Windows\WindowsUpdate.log
2015-02-07 06:50 - 2013-08-26 21:29 - 00000830 ____C () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-07 06:41 - 2012-12-08 08:19 - 00000000 ___DC () C:\Users\user\Desktop\meine
2015-02-07 06:12 - 2010-10-11 13:51 - 00000000 ___DC () C:\Users\user\Documents\OneNote-Notizbücher
2015-02-07 05:28 - 2009-07-14 05:34 - 00010272 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-07 05:28 - 2009-07-14 05:34 - 00010272 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-05 18:50 - 2012-10-13 20:31 - 00701616 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-02-05 18:50 - 2011-07-16 20:44 - 00071344 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-02-05 18:03 - 2014-08-06 10:31 - 00000000 ___DC () C:\ProgramData\Package Cache
2015-02-05 18:02 - 2013-08-26 21:32 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-05 18:01 - 2013-08-26 21:30 - 00000000 ___DC () C:\Program Files\Avira
2015-02-03 18:37 - 2009-12-09 15:58 - 00000000 ___DC () C:\Users\user\AppData\Local\Adobe
2015-01-26 23:17 - 2009-07-14 03:37 - 00000000 ___DC () C:\Windows\Microsoft.NET
2015-01-25 20:55 - 2014-08-14 18:22 - 00000000 ___DC () C:\Users\user\Desktop\tb
2015-01-24 22:48 - 2009-07-14 03:37 - 00000000 ___DC () C:\Windows\system32\NDF
2015-01-24 14:47 - 2011-05-26 10:04 - 235216202 _____ () C:\Windows\MEMORY.DMP
2015-01-24 14:47 - 2011-05-26 10:04 - 00000000 ___DC () C:\Windows\Minidump
2015-01-23 09:30 - 2011-11-03 01:20 - 00000000 ___DC () C:\Users\user\AppData\Local\MediaGet2
2015-01-20 18:50 - 2009-11-20 11:28 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-16 16:15 - 2013-08-27 00:28 - 00000000 ___DC () C:\Windows\system32\MRT
2015-01-16 15:53 - 2010-01-18 00:08 - 110348472 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-15 18:45 - 2010-01-12 08:18 - 00000000 ___DC () C:\Program Files\Google
2015-01-14 12:22 - 2009-07-14 05:33 - 00381176 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-14 12:17 - 2014-05-09 13:34 - 00000000 __SDC () C:\Windows\system32\CompatTel
2015-01-14 12:17 - 2009-07-14 03:37 - 00000000 ___DC () C:\Windows\AppCompat
2015-01-14 10:53 - 2009-11-20 13:11 - 00751992 _____ () C:\Windows\PFRO.log
2015-01-11 21:10 - 2010-10-11 13:17 - 00000000 ___DC () C:\ProgramData\Microsoft Help
2015-01-09 17:32 - 2014-07-30 11:53 - 00000000 ___DC () C:\Users\user\Desktop\stick
2015-01-09 16:20 - 2013-09-08 16:17 - 00002441 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-09 02:52 - 2012-10-28 17:03 - 00000000 ___DC () C:\Users\user\Desktop\kim sammel
2015-01-08 16:11 - 2014-08-14 18:18 - 00037384 ____C (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-01-08 16:10 - 2014-08-06 12:25 - 00136216 ____C (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-01-08 16:10 - 2014-08-06 12:25 - 00098160 ____C (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

==================== Files in the root of some directories =======

2013-08-24 20:43 - 2013-08-24 20:43 - 4188160 ____C () C:\Program Files\GUT2433.tmp
2013-04-01 00:50 - 2013-09-08 16:53 - 0000154 ____C () C:\Users\user\AppData\Roaming\Rim.Desktop.Exception.log
2013-04-01 00:48 - 2013-04-01 00:48 - 0001147 ____C () C:\Users\user\AppData\Roaming\Rim.Desktop.HttpServerSetup.log
2013-04-01 00:50 - 2013-09-08 16:53 - 0000154 ____C () C:\Users\user\AppData\Roaming\Rim.DesktopHelper.Exception.log
2010-01-11 01:39 - 2010-01-11 01:39 - 0008292 ____C () C:\Users\user\AppData\Roaming\UserTile.png
2010-01-10 21:42 - 2014-08-29 00:22 - 0001272 ____C () C:\Users\user\AppData\Roaming\wklnhst.dat
2011-04-02 23:15 - 2011-12-10 22:55 - 0048128 ____C () C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-12-20 12:51 - 2013-12-20 12:50 - 0351124 ____C () C:\Users\user\AppData\Local\mysearchdial-speeddial.crx
2011-06-24 12:58 - 2011-06-24 12:59 - 0000000 ____C () C:\Users\user\AppData\Local\{7B024D7D-8162-4DA4-8378-4BC395140FAA}
2010-01-12 08:24 - 2010-01-12 08:24 - 0000056 ___HC () C:\ProgramData\ezsidmv.dat

Some content of TEMP:
====================
C:\Users\user\AppData\Local\temp\9564uninstall.exe
C:\Users\user\AppData\Local\temp\AskSLib.dll
C:\Users\user\AppData\Local\temp\avgnt.exe
C:\Users\user\AppData\Local\temp\BlackBerryDeviceManager.exe
C:\Users\user\AppData\Local\temp\ConduitEngine.dll
C:\Users\user\AppData\Local\temp\contentDATs.exe
C:\Users\user\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplgwb6r.dll
C:\Users\user\AppData\Local\temp\ffunzip.exe
C:\Users\user\AppData\Local\temp\GLFC061.tmp.ConduitEngineSetup.exe
C:\Users\user\AppData\Local\temp\GoogleToolbarInstaller.exe
C:\Users\user\AppData\Local\temp\jre-6u17-windows-i586-iftw-rv.exe
C:\Users\user\AppData\Local\temp\jre-6u20-windows-i586-iftw-rv.exe
C:\Users\user\AppData\Local\temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\user\AppData\Local\temp\jre-7u15-windows-i586-iftw.exe
C:\Users\user\AppData\Local\temp\jre-7u17-windows-i586-iftw.exe
C:\Users\user\AppData\Local\temp\jre-7u25-windows-i586-iftw.exe
C:\Users\user\AppData\Local\temp\MSN9B55.exe
C:\Users\user\AppData\Local\temp\pcspeedmaxsetup.exe
C:\Users\user\AppData\Local\temp\prxGLFC061.tmp.tbDVDV.dll
C:\Users\user\AppData\Local\temp\SearchWithGoogleUpdate.exe
C:\Users\user\AppData\Local\temp\SecurityScan_Release.exe
C:\Users\user\AppData\Local\temp\setup.exe
C:\Users\user\AppData\Local\temp\SkypeSetup.exe
C:\Users\user\AppData\Local\temp\Sqlite3.dll
C:\Users\user\AppData\Local\temp\tbDVDV.dll
C:\Users\user\AppData\Local\temp\wlsetup-cvr.exe
C:\Users\user\AppData\Local\temp\{74B7A0AE-A509-44AF-891D-96825A4598A3}-35.0.1916.153_35.0.1916.114_chrome_updater.exe
C:\Users\user\AppData\Local\temp\{938A297E-9750-4411-B385-896C77F85AF5}-35.0.1916.114_chrome_installer.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 09:07

==================== End Of Log ============================

--- --- ---

--- --- ---

Es gab ein paar Probleme, habe Fotos gemacht.

... aber jetzt ist er problemlos hochgefahren, vor allem bereits sooo viel schneller,
ich bin ganz happy, danke dir

schrauber · 08.02.2015, 11:20

Wo sind die Logs der Tools?

blessy · 08.02.2015, 18:58

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-02-2015
Ran by user (administrator) on USER-PC on 08-02-2015 18:54:29
Running from C:\Users\user\Desktop\New folder
Loaded Profiles: user (Available profiles: user)
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
(Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\BCMWLTRY.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\ProgramData\DatacardService\HWDeviceService.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
() C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Dell) C:\Program Files\Battery Meter\BTMeter.exe
(Compal Electronics, Inc) C:\Program Files\CapsLKNotify\CapsLKNotify.exe
() C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtcmd.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtsvc.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.66\opera.exe
() C:\Program Files\Opera\27.0.1689.66\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.66\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.66\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.66\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.66\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.66\opera.exe
(Opera Software) C:\Program Files\Opera\27.0.1689.66\opera.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7547424 2009-06-16] (Realtek Semiconductor)
HKLM\...\Run: [BTMeter] => C:\Program Files\Battery Meter\BTMeter.exe [623984 2009-07-22] (Dell)
HKLM\...\Run: [CapsLKNotify] => C:\Program Files\CapsLKNotify\CapsLKNotify.exe [320880 2009-06-10] (Compal Electronics, Inc)
HKLM\...\Run: [Dell DataSafe Online] => C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe [1779952 2009-07-07] ()
HKLM\...\Run: [dellsupportcenter] => C:\Program Files\Dell Support Center\bin\sprtcmd.exe [206064 2009-06-03] (SupportSoft, Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2015-01-08] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126712 2014-12-31] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {32dabb42-1886-11df-a82d-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {35602fa2-3550-11e2-a74d-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {35602fc7-3550-11e2-a74d-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {4757b95a-a385-11e3-83f0-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {5340d7e2-77c1-11e2-9d8e-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {5340d7f7-77c1-11e2-9d8e-0024e8f2f0d6} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {5f59a581-fe5f-11de-9b42-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {5f59a59b-fe5f-11de-9b42-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {780be736-ff86-11de-ae2b-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {8b8cad91-cef2-11df-95d4-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {8b8cadc5-cef2-11df-95d4-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {a36f5ff3-8937-11df-af67-806e6f6e6963} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {b5cd9526-0cf6-11e0-8264-0c6076ff0764} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {be2c2944-3718-11e2-a674-001e101f8aaa} - D:\AutoRun.exe
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\MountPoints2: {d6c5e785-cd61-11df-9550-0c6076ff0764} - D:\AutoRun.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Mysearchdial Search
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\Software\Microsoft\Internet Explorer\Main,Start Page = Mysearchdial Search
HKU\S-1-5-21-1425939879-190374836-1102705582-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Dell - The Official Site | Dell Malaysia
URLSearchHook: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} -  No File
SearchScopes: HKLM -> DefaultScope {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKLM -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> DefaultScope {3ADA25D8-6B8E-4174-99B0-0340EBF9F87F} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=VIATDF&PC=VIATDF&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {3ADA25D8-6B8E-4174-99B0-0340EBF9F87F} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80196&lng=de
SearchScopes: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> {E1FB93A2-C203-4F7F-AD9B-8F1199E23FA5} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=kw&q={searchTerms}&locale=&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=b746bf59-8f6b-41c6-bd8f-56cdb4ce0ab3&apn_sauid=98616C0B-6F63-4D56-9456-89E6F03B5759
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File
Toolbar: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> No Name - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} -  No File
Toolbar: HKU\S-1-5-21-1425939879-190374836-1102705582-1000 -> No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{08650572-AE47-4832-8BDE-956C2964F5A3}: [NameServer] 212.23.115.148 212.23.115.150
Tcpip\..\Interfaces\{7B4B1029-983A-4AA6-BF81-6C41A7CFACF4}: [NameServer] 212.23.115.150 212.23.115.84
Tcpip\..\Interfaces\{D7E13746-1E44-4176-8C66-3FEF74D3DFE5}: [NameServer] 212.23.115.148 212.23.115.132

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default
FF SearchEngineOrder.1: Mysearchdial
FF Homepage: about:home
FF Keyword.URL: 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\searchplugins\Mysearchdial.xml
FF Extension: DownloadHelper - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-01-25]
FF Extension: 1-Click YouTube Video Downloader - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2015-01-25]
FF Extension: MySearchDial - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\Extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi [2014-07-30]

Chrome: 
=======
CHR HomePage: Default -> hxxp://start.mysearchdial.com/?f=1&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR DefaultSearchKeyword: Default -> mysearchdial.com
CHR DefaultSearchURL: Default -> hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-20]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-20]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-06]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-20]
CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-20]
CHR Extension: (Avira Browser Safety) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-08-06]
CHR Extension: (Google Wallet) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-20]
CHR Extension: (MySearchDial) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff [2014-04-24]
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-20]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKU\S-1-5-21-1425939879-190374836-1102705582-1000\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\user\AppData\Local\mysearchdial-speeddial.crx [2013-12-20]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2015-01-08] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2015-01-08] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [178424 2014-12-31] (Avira Operations GmbH & Co. KG)
S3 Blackberry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited) [File not signed]
S3 getPlusHelper; C:\Program Files\NOS\bin\getPlus_Helper.dll [51384 2009-12-01] (NOS Microsystems Ltd.)
R2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] ()
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S2 Mobile Partner. RunOuc; C:\Program Files\Mobile Partner\UpdateDog\ouc.exe [246112 2013-02-15] ()
R2 sprtsvc_DellSupportCenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968 2009-06-03] (SupportSoft, Inc.)
R2 UI Assistant Service; C:\Program Files\1&1 Surf-Stick\AssistantServices.exe [270672 2012-01-17] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-08-27] (Microsoft Corporation)
R2 wltrysvc; C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe [3086848 2009-07-17] (Dell Inc.) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AVerFx2hbtv; C:\Windows\System32\drivers\AVerFx2hbtv.sys [253824 2009-07-13] (AVerMedia TECHNOLOGIES, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2015-01-08] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-01-08] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-07-23] (Avira Operations GmbH & Co. KG)
R3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2009-07-17] (Broadcom Corporation)
R0 EMSC; C:\Windows\System32\DRIVERS\EMSC.SYS [13680 2009-06-26] (Windows (R) Win 7 DDK provider)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-03-26] (MBB Incorporated)
S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-13] (Ralink Technology Corp.)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2011-03-14] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2011-03-14] (RapidSolution Software AG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-07-23] (Avira GmbH)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 hwusbfake; system32\DRIVERS\ewusbfake.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-07 06:16 - 2015-02-07 06:54 - 00000000 ___DC () C:\Users\user\Desktop\tb 2015
2015-02-06 18:42 - 2015-02-06 18:42 - 00026380 ____C () C:\ComboFix.txt
2015-02-06 17:57 - 2011-06-26 07:45 - 00256000 ____C () C:\Windows\PEV.exe
2015-02-06 17:57 - 2010-11-07 18:20 - 00208896 ____C () C:\Windows\MBR.exe
2015-02-06 17:57 - 2009-04-20 05:56 - 00060416 ____C (NirSoft) C:\Windows\NIRCMD.exe
2015-02-06 17:57 - 2000-08-31 01:00 - 00518144 ____C (SteelWerX) C:\Windows\SWREG.exe
2015-02-06 17:57 - 2000-08-31 01:00 - 00406528 ____C (SteelWerX) C:\Windows\SWSC.exe
2015-02-06 17:57 - 2000-08-31 01:00 - 00098816 ____C () C:\Windows\sed.exe
2015-02-06 17:57 - 2000-08-31 01:00 - 00080412 ____C () C:\Windows\grep.exe
2015-02-06 17:57 - 2000-08-31 01:00 - 00068096 ____C () C:\Windows\zip.exe
2015-02-06 17:56 - 2015-02-07 14:17 - 00000000 __SDC () C:\ComboFix
2015-02-06 17:49 - 2015-02-06 18:42 - 00000000 ___DC () C:\Qoobox
2015-02-06 17:47 - 2015-02-07 14:17 - 00000000 __SDC () C:\32788R22FWJFW
2015-02-06 17:47 - 2015-02-06 17:47 - 00000000 ___DC () C:\Windows\erdnt
2015-02-05 18:02 - 2015-02-05 18:02 - 00001057 ____C () C:\Users\Public\Desktop\Avira.lnk
2015-02-03 18:31 - 2015-02-08 18:54 - 00000000 ___DC () C:\FRST
2015-01-27 19:44 - 2015-01-27 19:44 - 00001011 ____C () C:\Users\Public\Desktop\StreamTransport.lnk
2015-01-27 19:44 - 2015-01-27 19:44 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StreamTransport
2015-01-27 19:43 - 2015-01-27 19:44 - 00000000 ___DC () C:\Program Files\StreamTransport
2015-01-27 19:41 - 2015-01-27 19:41 - 17805707 ____C () C:\Users\user\Desktop\streamtransport_1.1.6.2.zip
2015-01-27 18:49 - 2015-01-27 18:49 - 00000000 ___DC () C:\Windows\pss
2015-01-25 21:00 - 2015-01-25 21:00 - 07165512 ____C () C:\Users\user\Downloads\wordpress-4.1-de_DE.zip
2015-01-24 14:47 - 2015-01-24 14:47 - 00351744 ____C () C:\Windows\Minidump\012415-24804-01.dmp
2015-01-15 18:54 - 2015-02-08 18:54 - 00000000 ___DC () C:\Users\user\Desktop\New folder
2015-01-15 18:39 - 2015-01-16 15:52 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-01-15 18:39 - 2015-01-16 15:52 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-15 18:39 - 2015-01-16 15:52 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-01-15 18:38 - 2015-01-17 12:41 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-15 18:38 - 2015-01-16 15:51 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-15 18:38 - 2015-01-16 15:51 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-15 18:38 - 2015-01-16 15:51 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-15 18:13 - 2015-01-15 18:13 - 00000000 _SHDC () C:\Users\user\AppData\Local\EmieUserList
2015-01-15 18:13 - 2015-01-15 18:13 - 00000000 _SHDC () C:\Users\user\AppData\Local\EmieSiteList
2015-01-15 18:13 - 2015-01-15 18:13 - 00000000 _SHDC () C:\Users\user\AppData\Local\EmieBrowserModeList
2015-01-14 12:17 - 2015-01-14 12:17 - 00000000 ___DC () C:\Windows\system32\appraiser
2015-01-14 11:46 - 2015-01-14 11:47 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-01-14 11:46 - 2015-01-14 11:47 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-01-14 11:46 - 2015-01-14 11:47 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-01-14 11:46 - 2015-01-14 11:47 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-01-14 11:46 - 2015-01-14 11:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-01-14 11:35 - 2015-01-14 11:35 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-01-14 11:17 - 2015-01-14 11:22 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2015-01-14 11:16 - 2015-01-14 11:22 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2015-01-14 11:16 - 2015-01-14 11:22 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2015-01-14 11:15 - 2015-01-14 11:22 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2015-01-11 19:45 - 2015-01-14 11:23 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2015-01-11 19:43 - 2015-01-14 12:00 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-01-11 19:43 - 2015-01-14 11:58 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-01-11 19:43 - 2015-01-14 11:58 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-01-11 19:43 - 2015-01-14 11:56 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-01-11 19:43 - 2015-01-14 11:56 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2015-01-11 19:42 - 2015-01-14 11:48 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2015-01-11 19:42 - 2015-01-14 11:46 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-01-11 19:42 - 2015-01-14 11:45 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-01-11 19:42 - 2015-01-14 11:44 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-01-11 19:42 - 2015-01-14 11:44 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-01-11 19:41 - 2015-01-14 11:42 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-01-11 19:41 - 2015-01-14 11:42 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-01-11 19:41 - 2015-01-14 11:41 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-01-11 19:41 - 2015-01-14 11:39 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-01-11 19:41 - 2015-01-14 11:36 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-01-11 19:41 - 2015-01-14 11:36 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-01-11 19:41 - 2015-01-14 11:36 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-01-11 19:41 - 2015-01-14 11:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-01-11 19:41 - 2015-01-14 11:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-01-11 19:41 - 2015-01-14 11:34 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-01-11 19:40 - 2015-01-14 11:38 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-01-11 19:40 - 2015-01-14 11:38 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-01-11 19:40 - 2015-01-14 11:36 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-01-11 19:40 - 2015-01-14 11:36 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-01-11 19:40 - 2015-01-14 11:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-01-11 19:40 - 2015-01-14 11:36 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-01-11 19:39 - 2015-01-14 11:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-01-11 19:39 - 2015-01-14 11:24 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-01-11 19:39 - 2015-01-14 11:09 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2015-01-11 19:39 - 2015-01-14 11:09 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2015-01-11 19:39 - 2015-01-14 11:09 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2015-01-11 19:38 - 2015-01-11 21:08 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-01-11 19:38 - 2015-01-11 21:08 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2015-01-11 19:35 - 2015-01-11 20:47 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2015-01-11 19:35 - 2015-01-11 20:46 - 05703168 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-01-11 19:16 - 2015-01-11 20:44 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2015-01-11 19:16 - 2015-01-11 20:44 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2015-01-11 19:16 - 2015-01-11 20:44 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2015-01-11 19:16 - 2015-01-11 20:44 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2015-01-11 19:16 - 2015-01-11 20:44 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2015-01-11 19:13 - 2015-01-14 11:57 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-01-11 19:11 - 2015-01-14 11:49 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2015-01-11 19:11 - 2015-01-14 11:49 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2015-01-11 19:11 - 2015-01-14 11:49 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-01-11 18:53 - 2015-01-11 20:25 - 00136632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-01-11 18:52 - 2015-01-14 11:24 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-01-11 18:52 - 2015-01-14 11:24 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-01-11 18:52 - 2015-01-14 11:24 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-01-11 18:52 - 2015-01-11 20:20 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2015-01-11 18:52 - 2015-01-11 20:20 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2015-01-11 18:52 - 2015-01-11 20:20 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2015-01-11 18:52 - 2015-01-11 20:20 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2015-01-11 18:52 - 2015-01-11 20:20 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2015-01-09 17:10 - 2015-01-27 18:23 - 00000000 __RDC () C:\Users\user\Dropbox
2015-01-09 17:10 - 2015-01-09 17:10 - 00001086 ____C () C:\Users\user\Desktop\Dropbox.lnk
2015-01-09 17:02 - 2015-01-09 17:02 - 00000000 ___DC () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-01-09 16:55 - 2015-01-27 16:31 - 00000000 ___DC () C:\Users\user\AppData\Roaming\Dropbox
2015-01-09 16:55 - 2015-01-09 16:55 - 00324112 ____C (Dropbox, Inc.) C:\Users\user\Downloads\DropboxInstaller.exe
2015-01-09 15:29 - 2015-01-09 15:30 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-01-09 15:29 - 2015-01-09 15:30 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-01-09 15:29 - 2015-01-09 15:30 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-01-09 15:29 - 2015-01-09 15:30 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-01-09 15:28 - 2015-01-09 15:49 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-01-09 15:28 - 2015-01-09 15:49 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-01-09 15:28 - 2015-01-09 15:49 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-01-09 15:27 - 2015-01-09 15:30 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-01-09 15:27 - 2015-01-09 15:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-08 18:50 - 2013-08-26 21:29 - 00000830 ____C () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-08 17:36 - 2009-07-14 05:34 - 00010272 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-08 17:36 - 2009-07-14 05:34 - 00010272 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-08 17:22 - 2009-07-14 05:55 - 01844101 _____ () C:\Windows\WindowsUpdate.log
2015-02-08 17:16 - 2010-10-01 15:04 - 00000000 ___DC () C:\Program Files\Opera
2015-02-08 17:11 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-08 17:11 - 2009-07-14 05:39 - 00220956 _____ () C:\Windows\setupact.log
2015-02-07 18:50 - 2012-10-13 20:31 - 00701616 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-02-07 18:50 - 2011-07-16 20:44 - 00071344 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-02-07 14:18 - 2009-07-14 03:37 - 00000000 ___DC () C:\Windows\system32\wfp
2015-02-07 14:17 - 2014-05-31 17:09 - 00000000 ___DC () C:\Program Files\1&1 Surf-Stick
2015-02-07 14:17 - 2010-12-13 20:29 - 00000000 ___DC () C:\Program Files\Mozilla Firefox
2015-02-07 14:17 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration
2015-02-07 14:13 - 2009-07-14 03:37 - 00000000 _RHDC () C:\Users\Default
2015-02-07 06:41 - 2012-12-08 08:19 - 00000000 ___DC () C:\Users\user\Desktop\meine
2015-02-07 06:12 - 2010-10-11 13:51 - 00000000 ___DC () C:\Users\user\Documents\OneNote-Notizbücher
2015-02-05 18:03 - 2014-08-06 10:31 - 00000000 ___DC () C:\ProgramData\Package Cache
2015-02-05 18:02 - 2013-08-26 21:32 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-05 18:01 - 2013-08-26 21:30 - 00000000 ___DC () C:\Program Files\Avira
2015-02-03 18:37 - 2009-12-09 15:58 - 00000000 ___DC () C:\Users\user\AppData\Local\Adobe
2015-01-26 23:17 - 2009-07-14 03:37 - 00000000 ___DC () C:\Windows\Microsoft.NET
2015-01-25 20:55 - 2014-08-14 18:22 - 00000000 ___DC () C:\Users\user\Desktop\tb
2015-01-24 22:48 - 2009-07-14 03:37 - 00000000 ___DC () C:\Windows\system32\NDF
2015-01-24 14:47 - 2011-05-26 10:04 - 235216202 _____ () C:\Windows\MEMORY.DMP
2015-01-24 14:47 - 2011-05-26 10:04 - 00000000 ___DC () C:\Windows\Minidump
2015-01-23 09:30 - 2011-11-03 01:20 - 00000000 ___DC () C:\Users\user\AppData\Local\MediaGet2
2015-01-20 18:50 - 2009-11-20 11:28 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-16 16:15 - 2013-08-27 00:28 - 00000000 ___DC () C:\Windows\system32\MRT
2015-01-16 15:53 - 2010-01-18 00:08 - 110348472 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-15 18:45 - 2010-01-12 08:18 - 00000000 ___DC () C:\Program Files\Google
2015-01-14 12:22 - 2009-07-14 05:33 - 00381176 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-14 12:17 - 2014-05-09 13:34 - 00000000 __SDC () C:\Windows\system32\CompatTel
2015-01-14 12:17 - 2009-07-14 03:37 - 00000000 ___DC () C:\Windows\AppCompat
2015-01-14 10:53 - 2009-11-20 13:11 - 00751992 _____ () C:\Windows\PFRO.log
2015-01-11 21:10 - 2010-10-11 13:17 - 00000000 ___DC () C:\ProgramData\Microsoft Help
2015-01-09 17:32 - 2014-07-30 11:53 - 00000000 ___DC () C:\Users\user\Desktop\stick
2015-01-09 16:20 - 2013-09-08 16:17 - 00002441 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-09 02:52 - 2012-10-28 17:03 - 00000000 ___DC () C:\Users\user\Desktop\kim sammel

==================== Files in the root of some directories =======

2013-08-24 20:43 - 2013-08-24 20:43 - 4188160 ____C () C:\Program Files\GUT2433.tmp
2013-04-01 00:50 - 2013-09-08 16:53 - 0000154 ____C () C:\Users\user\AppData\Roaming\Rim.Desktop.Exception.log
2013-04-01 00:48 - 2013-04-01 00:48 - 0001147 ____C () C:\Users\user\AppData\Roaming\Rim.Desktop.HttpServerSetup.log
2013-04-01 00:50 - 2013-09-08 16:53 - 0000154 ____C () C:\Users\user\AppData\Roaming\Rim.DesktopHelper.Exception.log
2010-01-11 01:39 - 2010-01-11 01:39 - 0008292 ____C () C:\Users\user\AppData\Roaming\UserTile.png
2010-01-10 21:42 - 2014-08-29 00:22 - 0001272 ____C () C:\Users\user\AppData\Roaming\wklnhst.dat
2011-04-02 23:15 - 2011-12-10 22:55 - 0048128 ____C () C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-12-20 12:51 - 2013-12-20 12:50 - 0351124 ____C () C:\Users\user\AppData\Local\mysearchdial-speeddial.crx
2011-06-24 12:58 - 2011-06-24 12:59 - 0000000 ____C () C:\Users\user\AppData\Local\{7B024D7D-8162-4DA4-8378-4BC395140FAA}
2010-01-12 08:24 - 2010-01-12 08:24 - 0000056 ___HC () C:\ProgramData\ezsidmv.dat

Some content of TEMP:
====================
C:\Users\user\AppData\Local\temp\9564uninstall.exe
C:\Users\user\AppData\Local\temp\AskSLib.dll
C:\Users\user\AppData\Local\temp\avgnt.exe
C:\Users\user\AppData\Local\temp\BlackBerryDeviceManager.exe
C:\Users\user\AppData\Local\temp\ConduitEngine.dll
C:\Users\user\AppData\Local\temp\contentDATs.exe
C:\Users\user\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplgwb6r.dll
C:\Users\user\AppData\Local\temp\ffunzip.exe
C:\Users\user\AppData\Local\temp\GLFC061.tmp.ConduitEngineSetup.exe
C:\Users\user\AppData\Local\temp\GoogleToolbarInstaller.exe
C:\Users\user\AppData\Local\temp\jre-6u17-windows-i586-iftw-rv.exe
C:\Users\user\AppData\Local\temp\jre-6u20-windows-i586-iftw-rv.exe
C:\Users\user\AppData\Local\temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\user\AppData\Local\temp\jre-7u15-windows-i586-iftw.exe
C:\Users\user\AppData\Local\temp\jre-7u17-windows-i586-iftw.exe
C:\Users\user\AppData\Local\temp\jre-7u25-windows-i586-iftw.exe
C:\Users\user\AppData\Local\temp\MSN9B55.exe
C:\Users\user\AppData\Local\temp\pcspeedmaxsetup.exe
C:\Users\user\AppData\Local\temp\prxGLFC061.tmp.tbDVDV.dll
C:\Users\user\AppData\Local\temp\SearchWithGoogleUpdate.exe
C:\Users\user\AppData\Local\temp\SecurityScan_Release.exe
C:\Users\user\AppData\Local\temp\setup.exe
C:\Users\user\AppData\Local\temp\SkypeSetup.exe
C:\Users\user\AppData\Local\temp\Sqlite3.dll
C:\Users\user\AppData\Local\temp\tbDVDV.dll
C:\Users\user\AppData\Local\temp\wlsetup-cvr.exe
C:\Users\user\AppData\Local\temp\{74B7A0AE-A509-44AF-891D-96825A4598A3}-35.0.1916.153_35.0.1916.114_chrome_updater.exe
C:\Users\user\AppData\Local\temp\{938A297E-9750-4411-B385-896C77F85AF5}-35.0.1916.114_chrome_installer.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 09:07

==================== End Of Log ============================

--- --- ---

schrauber · 08.02.2015, 19:06

MBAM?AdwCleaner? JRT?

blessy · 08.02.2015, 20:30

Combofix Logfile:

Code:

ATTFilter

ComboFix 15-02-08.01 - user 08.02.2015  19:40:34.1.2 - x86
Microsoft Windows 7 Starter   6.1.7601.1.1252.49.1033.18.1014.263 [GMT 1:00]
ausgeführt von:: c:\users\user\Desktop\New folder\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\user\AppData\Local\temp\avgnt.exe\Avira.OE.ExtApi.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-01-08 bis 2015-02-08  ))))))))))))))))))))))))))))))
.
.
2015-02-08 18:58 . 2015-02-08 19:05	--------	dc----w-	c:\users\user\AppData\Local\temp
2015-02-03 17:31 . 2015-02-08 17:57	--------	dc----w-	C:\FRST
2015-01-27 18:43 . 2015-01-27 18:44	--------	dc----w-	c:\program files\StreamTransport
2015-01-15 17:39 . 2015-01-16 14:52	115712	----a-w-	c:\windows\system32\ieUnatt.exe
2015-01-15 17:39 . 2015-01-16 14:52	3971512	----a-w-	c:\windows\system32\ntkrnlpa.exe
2015-01-15 17:39 . 2015-01-16 14:52	3916728	----a-w-	c:\windows\system32\ntoskrnl.exe
2015-01-15 17:38 . 2015-01-16 14:51	74240	----a-w-	c:\windows\system32\TSWbPrxy.exe
2015-01-15 17:38 . 2015-01-16 14:51	164864	----a-w-	c:\windows\system32\profsvc.dll
2015-01-15 17:38 . 2015-01-17 11:41	116224	----a-w-	c:\windows\system32\drivers\mrxdav.sys
2015-01-15 17:38 . 2015-01-16 14:51	242688	----a-w-	c:\windows\system32\nlasvc.dll
2015-01-15 17:13 . 2015-01-15 17:13	--------	dcsh--w-	c:\users\user\AppData\Local\EmieUserList
2015-01-15 17:13 . 2015-01-15 17:13	--------	dcsh--w-	c:\users\user\AppData\Local\EmieBrowserModeList
2015-01-15 17:13 . 2015-01-15 17:13	--------	dcsh--w-	c:\users\user\AppData\Local\EmieSiteList
2015-01-14 11:17 . 2015-01-14 11:17	--------	dc----w-	c:\windows\system32\appraiser
2015-01-14 10:46 . 2015-01-14 10:47	23040	----a-w-	c:\windows\system32\mfpmp.exe
2015-01-14 10:46 . 2015-01-14 10:47	2048	----a-w-	c:\windows\system32\mferror.dll
2015-01-14 10:46 . 2015-01-14 10:47	103424	----a-w-	c:\windows\system32\mfps.dll
2015-01-14 10:46 . 2015-01-14 10:47	50176	----a-w-	c:\windows\system32\rrinstaller.exe
2015-01-14 10:46 . 2015-01-14 10:47	3209728	----a-w-	c:\windows\system32\mf.dll
2015-01-14 10:35 . 2015-01-14 10:35	2285056	----a-w-	c:\windows\system32\msmpeg2vdec.dll
2015-01-14 10:17 . 2015-01-14 10:22	99480	----a-w-	c:\windows\system32\infocardapi.dll
2015-01-14 10:16 . 2015-01-14 10:22	8856	----a-w-	c:\windows\system32\icardres.dll
2015-01-14 10:16 . 2015-01-14 10:22	619672	----a-w-	c:\windows\system32\icardagt.exe
2015-01-14 10:15 . 2015-01-14 10:22	35480	----a-w-	c:\windows\system32\TsWpfWrp.exe
2015-01-11 18:45 . 2015-01-14 10:23	793600	----a-w-	c:\windows\system32\TSWorkspace.dll
2015-01-11 18:43 . 2015-01-14 11:00	571904	----a-w-	c:\windows\system32\oleaut32.dll
2015-01-11 18:43 . 2015-01-14 10:58	74752	----a-w-	c:\windows\system32\drivers\tdx.sys
2015-01-11 18:43 . 2015-01-14 10:58	1230336	----a-w-	c:\windows\system32\WindowsCodecs.dll
2015-01-11 18:43 . 2015-01-14 10:56	550912	----a-w-	c:\windows\system32\kerberos.dll
2015-01-11 18:43 . 2015-01-14 10:56	186880	----a-w-	c:\windows\system32\pku2u.dll
2015-01-11 18:42 . 2015-01-14 10:48	701440	----a-w-	c:\windows\system32\IMJP10K.DLL
2015-01-11 18:42 . 2015-01-14 10:46	2363904	----a-w-	c:\windows\system32\msi.dll
2015-01-11 18:42 . 2015-01-14 10:45	305152	----a-w-	c:\windows\system32\gdi32.dll
2015-01-11 18:42 . 2015-01-14 10:44	1237504	----a-w-	c:\windows\system32\msxml3.dll
2015-01-11 18:42 . 2015-01-14 10:44	2048	----a-w-	c:\windows\system32\msxml3r.dll
2015-01-11 18:40 . 2015-01-14 10:36	468992	----a-w-	c:\program files\Internet Explorer\ieinstal.exe
2015-01-11 18:39 . 2015-01-14 10:09	1131664	----a-w-	c:\windows\system32\dfshim.dll
2015-01-11 18:39 . 2015-01-14 10:09	156824	----a-w-	c:\windows\system32\mscorier.dll
2015-01-11 18:39 . 2015-01-14 10:09	81560	----a-w-	c:\windows\system32\mscories.dll
2015-01-11 18:39 . 2015-01-14 10:34	2048	----a-w-	c:\windows\system32\tzres.dll
2015-01-11 18:39 . 2015-01-14 10:24	1987584	----a-w-	c:\windows\system32\d3d10warp.dll
2015-01-11 18:38 . 2015-01-11 20:08	67584	----a-w-	c:\windows\system32\packager.dll
2015-01-11 18:38 . 2015-01-11 20:08	2744320	----a-w-	c:\windows\system32\rdpcorets.dll
2015-01-11 18:35 . 2015-01-11 19:47	155136	----a-w-	c:\windows\system32\charmap.exe
2015-01-11 18:35 . 2015-01-11 19:46	5703168	----a-w-	c:\windows\system32\mstscax.dll
2015-01-11 18:16 . 2015-01-11 19:44	157696	----a-w-	c:\windows\system32\winsta.dll
2015-01-11 18:16 . 2015-01-11 19:44	304128	----a-w-	c:\windows\system32\winlogon.exe
2015-01-11 18:16 . 2015-01-11 19:44	130048	----a-w-	c:\windows\system32\rdpcorekmts.dll
2015-01-11 18:16 . 2015-01-11 19:44	184320	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2015-01-11 18:16 . 2015-01-11 19:44	31232	----a-w-	c:\windows\system32\drivers\tssecsrv.sys
2015-01-11 18:13 . 2015-01-14 10:57	654336	----a-w-	c:\windows\system32\rpcrt4.dll
2015-01-11 18:11 . 2015-01-14 10:49	730048	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2015-01-11 18:11 . 2015-01-14 10:49	219072	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2015-01-11 18:11 . 2015-01-14 10:49	107520	----a-w-	c:\windows\system32\cdd.dll
2015-01-11 17:53 . 2015-01-11 19:25	1059840	----a-w-	c:\windows\system32\lsasrv.dll
2015-01-11 17:53 . 2015-01-11 19:25	681984	----a-w-	c:\windows\system32\adtschema.dll
2015-01-11 17:53 . 2015-01-11 19:25	523776	----a-w-	c:\windows\system32\termsrv.dll
2015-01-11 17:53 . 2015-01-11 19:25	146432	----a-w-	c:\windows\system32\msaudite.dll
2015-01-11 17:53 . 2015-01-11 19:25	136632	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2015-01-11 17:52 . 2015-01-14 10:24	1805824	----a-w-	c:\windows\system32\authui.dll
2015-01-11 17:52 . 2015-01-14 10:24	101824	----a-w-	c:\windows\system32\consent.exe
2015-01-11 17:52 . 2015-01-14 10:24	337408	----a-w-	c:\windows\system32\msihnd.dll
2015-01-11 17:52 . 2015-01-11 19:20	1177088	----a-w-	c:\windows\system32\WsmSvc.dll
2015-01-11 17:52 . 2015-01-11 19:20	248832	----a-w-	c:\windows\system32\WSManMigrationPlugin.dll
2015-01-11 17:52 . 2015-01-11 19:20	198656	----a-w-	c:\windows\system32\WSManHTTPConfig.exe
2015-01-11 17:52 . 2015-01-11 19:20	214016	----a-w-	c:\windows\system32\WsmWmiPl.dll
2015-01-11 17:52 . 2015-01-11 19:20	145920	----a-w-	c:\windows\system32\WsmAuto.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-07 17:50 . 2012-10-13 19:31	701616	-c--a-w-	c:\windows\system32\FlashPlayerApp.exe
2015-02-07 17:50 . 2011-07-16 19:44	71344	-c--a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2015-01-09 14:56 . 2010-06-24 09:33	23256	-c--a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2015-01-09 14:49 . 2015-01-09 14:28	36320	----a-w-	c:\windows\system32\wups.dll
2015-01-09 14:49 . 2015-01-09 14:28	92672	----a-w-	c:\windows\system32\wudriver.dll
2015-01-09 14:49 . 2015-01-09 14:28	581600	----a-w-	c:\windows\system32\wuapi.dll
2015-01-09 14:30 . 2015-01-09 14:27	179656	----a-w-	c:\windows\system32\wuwebv.dll
2015-01-09 14:30 . 2015-01-09 14:27	33792	----a-w-	c:\windows\system32\wuapp.exe
2015-01-09 14:30 . 2015-01-09 14:29	54240	----a-w-	c:\windows\system32\wuauclt.exe
2015-01-09 14:30 . 2015-01-09 14:29	45536	----a-w-	c:\windows\system32\wups2.dll
2015-01-09 14:30 . 2015-01-09 14:29	2425856	----a-w-	c:\windows\system32\wucltux.dll
2015-01-09 14:30 . 2015-01-09 14:29	1973728	----a-w-	c:\windows\system32\wuaueng.dll
2015-01-08 15:11 . 2014-08-14 17:18	37384	-c--a-w-	c:\windows\system32\drivers\avnetflt.sys
2015-01-08 15:10 . 2014-08-06 11:25	136216	-c--a-w-	c:\windows\system32\drivers\avipbb.sys
2015-01-08 15:10 . 2014-08-06 11:25	98160	-c--a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-11-18 13:56 . 2014-11-18 13:56	1202848	-c--a-w-	c:\windows\system32\FM20.DLL
2013-08-24 19:43 . 2013-08-24 19:43	4188160	-c--a-w-	c:\program files\GUT2433.tmp
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	-c--a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-06-16 7547424]
"BTMeter"="c:\program files\Battery Meter\BTMeter.exe" [2009-07-22 623984]
"CapsLKNotify"="c:\program files\CapsLKNotify\CapsLKNotify.exe" [2009-06-09 320880]
"Dell DataSafe Online"="c:\program files\Dell DataSafe Online\DataSafeOnline.exe" [2009-07-07 1779952]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2015-01-08 702768]
"Avira Systray"="c:\program files\Avira\My Avira\Avira.OE.Systray.exe" [2014-12-31 126712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^user^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^user^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2009-07-17 01:06	4562944	----a-w-	c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-09-23 11:30	173592	-c--a-w-	c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaGet2]
2015-01-23 08:29	13501416	-c--a-w-	c:\users\user\AppData\Local\MediaGet2\mediaget.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mobilegeni daemon]
c:\program files\Mobogenie\DaemonProcess.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-23 11:30	150552	-c--a-w-	c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RIMBBLaunchAgent.exe]
2013-01-17 14:08	267792	-c--a-w-	c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-05-29 10:53	1529128	----a-w-	c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UIExec]
2012-01-17 16:49	153424	-c--a-w-	c:\program files\1&1 Surf-Stick\UIExec.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WSED]
2009-05-27 21:24	247080	----a-w-	c:\program files\WSED\WSED.exe
.
R2 Mobile Partner. RunOuc;Mobile Partner. OUC;c:\program files\Mobile Partner\UpdateDog\ouc.exe [2013-02-15 246112]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-10-23 172192]
R3 AVerFx2hbtv;AVerMedia USB SW Hybrid Tuner;c:\windows\system32\drivers\AVerFx2hbtv.sys [2009-07-13 253824]
R3 Blackberry Device Manager;Blackberry Device Manager;c:\program files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [2013-01-18 577536]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-14 45736]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2013-02-15 102784]
R3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\DRIVERS\ewusbwwan.sys [2013-02-15 353280]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-01-14 102912]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2011-03-26 9216]
R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2014-05-09 14848]
R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys [2011-03-14 31848]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-06-24 167424]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2014-05-09 49152]
R3 usbrndis6;USB RNDIS6 Adapter;c:\windows\system32\DRIVERS\usb80236.sys [2013-02-12 15872]
S0 EMSC;COMPAL Embedded System Control;c:\windows\system32\DRIVERS\EMSC.SYS [2009-06-26 13680]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2014-07-23 37352]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSrv.exe [2009-03-31 81920]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2015-01-08 431920]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files\Avira\My Avira\Avira.OE.ServiceHost.exe [2014-12-31 178424]
S2 HWDeviceService.exe;HWDeviceService.exe;c:\programdata\DatacardService\HWDeviceService.exe [2011-03-14 271712]
S2 UI Assistant Service;UI Assistant Service;c:\program files\1&1 Surf-Stick\AssistantServices.exe [2012-01-17 270672]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-03-12 143840]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2013-02-15 73216]
S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys [2011-03-14 31848]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc
getPlusHelper	REG_MULTI_SZ   	getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2015-02-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-13 17:50]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.mysearchdial.com/?f=1&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
mStart Page = hxxp://start.mysearchdial.com/?f=1&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
IE: Free YouTube to MP3 Converter - c:\users\user\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{08650572-AE47-4832-8BDE-956C2964F5A3}: NameServer = 212.23.115.148 212.23.115.150
TCP: Interfaces\{7B4B1029-983A-4AA6-BF81-6C41A7CFACF4}: NameServer = 212.23.115.150 212.23.115.84
TCP: Interfaces\{D7E13746-1E44-4176-8C66-3FEF74D3DFE5}: NameServer = 212.23.115.148 212.23.115.132
FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k2s8z6r8.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - 
FF - user.js: extensions.mysearchdial.hmpg - true
FF - user.js: extensions.mysearchdial.hmpgUrl - hxxp://start.mysearchdial.com/?f=1&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
FF - user.js: extensions.mysearchdial.dfltSrch - true
FF - user.js: extensions.mysearchdial.srchPrvdr - Mysearchdial
FF - user.js: extensions.mysearchdial.dnsErr - true
FF - user.js: extensions.mysearchdial_i.newTab - false
FF - user.js: extensions.mysearchdial.newTabUrl - hxxp://start.mysearchdial.com/?f=2&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=
FF - user.js: extensions.mysearchdial.tlbrSrchUrl - hxxp://start.mysearchdial.com/?f=3&a=irmsd1202&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=63991871&ir=&q=
FF - user.js: extensions.mysearchdial.id - 904CE5296B7E4335
FF - user.js: extensions.mysearchdial.instlDay - 16059
FF - user.js: extensions.mysearchdial.vrsn - 1.8.21.0
FF - user.js: extensions.mysearchdial.vrsni - 1.8.21.0
FF - user.js: extensions.mysearchdial_i.vrsnTs - 1.8.21.012:49
FF - user.js: extensions.mysearchdial.prtnrId - mysearchdial
FF - user.js: extensions.mysearchdial.prdct - mysearchdial
FF - user.js: extensions.mysearchdial.aflt - irmsd1202
FF - user.js: extensions.mysearchdial_i.smplGrp - none
FF - user.js: extensions.mysearchdial.tlbrId - base
FF - user.js: extensions.mysearchdial.instlRef - 
FF - user.js: extensions.mysearchdial.dfltLng - 
FF - user.js: extensions.mysearchdial.appId - {CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}
FF - user.js: extensions.mysearchdial.excTlbr - false
FF - user.js: extensions.mysearchdial_i.hmpg - true
FF - user.js: extensions.mysearchdial.cr - 63991871
FF - user.js: extensions.mysearchdial.cd - 2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R
FF - user.js: extensions.irmysearch.aflt - irmsd1202
FF - user.js: extensions.irmysearch.instlRef - 
FF - user.js: extensions.irmysearch.cr - 63991871
FF - user.js: extensions.irmysearch.cd - 2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBzyyC0ByB0EyEtAtAyDtN0D0Tzu0CyBtBtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{872b5b88-9db5-4310-bdd0-ac189557e5f5} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
WebBrowser-{41564952-412D-5637-00A7-7A786E7484D7} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
c:\program files\Dell\Dell Wireless WLAN Card\bcmwltry.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\programdata\Mobile Partner\OnlineUpdate\ouc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-02-08  20:16:21 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2015-02-08 19:16
ComboFix2.txt  2015-02-06 17:42
.
Vor Suchlauf: 141.952.532.480 bytes free
Nach Suchlauf: 142.466.830.336 bytes free
.
- - End Of File - - 06C13FE5D3D6FEEF50BEC0631344C830

--- --- ---
5C616939100B85E558DA92B899A0FC36

Hallo lieber Schrauber,

MBAM?AdwCleaner? JRT? - Was ist das denn?

GERNE mach ich, was du mir sagst, nur verstehe ich grad nur Bahnhof, sorry

Liebe Grüsse von Hilde

31.01.2015, 21:29	#4
schrauber /// the machine /// TB-Ausbilder	advare gen4, dealply, browse fox... ok __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

03.02.2015, 21:51	#6
schrauber /// the machine /// TB-Ausbilder	advare gen4, dealply, browse fox... Die Addition.txt fehlt noch. Und ja, das kann jeder lesen. Da steht aber nix drin mit dem jemand hacken könnte oder so. __________________ --> advare gen4, dealply, browse fox...

08.02.2015, 11:20	#12
schrauber /// the machine /// TB-Ausbilder	advare gen4, dealply, browse fox... Wo sind die Logs der Tools? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

08.02.2015, 19:06	#14
schrauber /// the machine /// TB-Ausbilder	advare gen4, dealply, browse fox... MBAM?AdwCleaner? JRT? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

advare gen4, dealply, browse fox...

Plagegeister aller Art und deren Bekämpfung: advare gen4, dealply, browse fox...