verstellte Internet-Suchfunktion

Lucia001 · 08.02.2015, 11:08

Hallo Schrauber,

normalerweise nutze ich Mozilla und nutze No-Script, damit nicht ungefragt Skripte geöffnet werden. Bei meinem VPN-Zugang geht das nicht: für Journal-Recherche nutze ich Opera und das geht nur ohne No-Script, sonst kann ich mich nicht einloggen.

Bei den Recherchen wurde ich gestern aufmerksam gemacht, dass ich meinen Flash-Player aktualiseren muss, (was ich bei mozilla bereits getan habe). Aus Dummheit habe ich da draufgeklickt und wurde zu einer Adobe-Seite geführt (ich weiss aber nicht, ob die echt war).

Seit dem bin ich der Meinung, dass ich bei Eingabe von Suchbegiffen nur noch die Sachen finde, die ich garnicht suche.

Hast Du eine Idee?

Ein FRST-File habe ich hier schon gemacht:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2015
Ran by Jane (administrator) on STUART on 08-02-2015 10:50:02
Running from D:\Jane\Privat\Computersicherheit
Loaded Profiles: Jane & (Available profiles: Jane)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(FileOpen Systems Inc.) C:\Program Files\FileOpen\Services\FileOpenManagerService64.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Aladdin Knowledge Systems Ltd.) C:\Windows\System32\hasplms.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\ProgramData\MobileBrServ\mbbService.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NTI, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
() C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\capiws.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(FileOpen Systems Inc.) C:\Program Files\FileOpen\Services\FileOpenBroker64.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 15\SteganosBrowserMonitor.exe
(FileHippo.com) C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Nokia\Nokia Internet Modem\NokiaInternetModem_AppStart.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 15\SteganosHotKeyService.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 15\fredirstarter.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\winword.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\excel.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
Failed to access process -> dllhost.exe
Failed to access process -> dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-29] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324608 2010-06-10] (Alcor Micro Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860040 2011-01-05] (Acer Incorporated)
HKLM\...\Run: [FileOpenBroker] => C:\Program Files\FileOpen\Services\FileOpenBroker64.exe [1092528 2012-10-17] (FileOpen Systems Inc.)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] => C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-09-18] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisUpdate] => C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-09-18] (Egis Technology Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [340336 2010-09-28] (Egis Technology Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-11] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [NokiaInternetModem_AppStart.exe] => C:\Program Files (x86)\Nokia\Nokia Internet Modem\NokiaInternetModem.exe [138368 2011-12-02] (Nokia)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [134624 2014-07-23] (Check Point Software Technologies Ltd.)
HKLM-x32\...\Run: [Steganos HotKeys] => C:\Program Files (x86)\Steganos Safe 15\SteganosHotKeyService.exe [99840 2013-09-24] (Steganos Software GmbH)
HKLM-x32\...\Run: [SAFE15 File Redirection Starter] => C:\Program Files (x86)\Steganos Safe 15\fredirstarter.exe [17408 2014-02-21] (Steganos Software GmbH)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2010-11-26] (Acresso Corporation)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\Run: [SAFE15 Browser Monitor] => C:\Program Files (x86)\Steganos Safe 15\SteganosBrowserMonitor.exe [70656 2014-02-21] (Steganos Software GmbH)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [695808 2014-09-10] (FileHippo.com)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2010-11-26] (Acresso Corporation)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [SAFE15 Browser Monitor] => C:\Program Files (x86)\Steganos Safe 15\SteganosBrowserMonitor.exe [70656 2014-02-21] (Steganos Software GmbH)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [695808 2014-09-10] (FileHippo.com)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2358124735-2455735417-86444415-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2358124735-2455735417-86444415-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{8BF89013-52EF-4306-AFD1-0F8F6B795861}: [NameServer] 139.7.30.125 139.7.30.126

FireFox:
========
FF ProfilePath: C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030
FF Homepage: hxxp://www.christianehohensee.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @cdisys.com/SafeView -> C:\Program Files (x86)\SafeView\npsfvw.dll (C.D.I. Systems (1992) Ltd.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\searchplugins\webde-suche.xml
FF Extension: NoScript - C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-10-08]
FF Extension: Adblock Plus - C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-03]
FF Extension: DownThemAll! - C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2013-10-08]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-30]
FF HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

Chrome:
=======
CHR Profile: C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-04-20]
CHR Extension: (Google Drive) - C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-04-20]
CHR Extension: (YouTube) - C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-20]
CHR Extension: (Google Search) - C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-20]
CHR Extension: (Chrome In-App Payments service) - C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-03]
CHR Extension: (Gmail) - C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-20]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
R2 FileOpenManagerService; C:\Program Files\FileOpen\Services\FileOpenManagerService64.exe [335288 2012-10-17] (FileOpen Systems Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] ()
R2 NTISchedulerSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144640 2010-04-17] (NTI, Inc.)
R2 OpenVPNAccessClient; C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\capiws.exe [24064 2012-10-12] () [File not signed]
S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [38200 2014-12-01] (The OpenVPN Project)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015i\RpcAgentSrv.exe [73200 2014-12-17] (SiSoftware) [File not signed]
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [3596240 2014-07-23] (Check Point Software Technologies Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZaPrivacyService.exe [93712 2014-07-03] (Check Point Software Technologies, Ltd.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-08] (Malwarebytes Corporation)
S3 nokia_usb_modem_cdc_acm; C:\Windows\System32\DRIVERS\nokia_usb_modem_cdc_acm.sys [79872 2011-06-22] (Nokia)
S3 nokia_usb_modem_cdc_ecm; C:\Windows\System32\DRIVERS\nokia_usb_modem_cdc_ecm.sys [58880 2011-06-22] (Nokia)
S3 nokia_usb_modem_cpo; C:\Windows\System32\DRIVERS\nokia_usb_modem_cpo.sys [14336 2011-06-22] (Nokia)
S3 nokia_usb_modem_ecm_enum; C:\Windows\System32\DRIVERS\nokia_usb_modem_ecm_enum.sys [56320 2011-06-22] (Nokia)
S3 nokia_usb_modem_ecm_enum_filter; C:\Windows\System32\DRIVERS\nokia_usb_modem_ecm_enum_filter.sys [56320 2011-06-22] (Nokia)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-08-16] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-08-16] ()
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015i\WNt600x64\Sandra.sys [23112 2009-08-07] (SiSoftware)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2014-01-30] (Softwareentwicklung Remus - ArchiCrypt - )
R3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450456 2014-07-22] (Check Point Software Technologies Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-04 10:20 - 2015-02-04 10:20 - 00000093 _____ () C:\Windows\wininit.ini
2015-02-03 14:00 - 2015-02-04 09:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-02-03 11:47 - 2015-02-03 11:48 - 00237056 _____ () C:\Users\Jane\Desktop\STUNDEN2015-CH.xls
2015-02-01 22:27 - 2014-11-11 11:33 - 31389440 _____ (Mozilla) C:\Users\Jane\Downloads\Thunderbird Setup 34.0b1.exe
2015-02-01 19:48 - 2015-02-01 21:04 - 00007868 _____ () C:\Users\Jane\Desktop\Mircoarray-Überprüfungen der Pathways.txt
2015-02-01 06:46 - 2015-02-01 06:46 - 00000830 _____ () C:\Users\Jane\Documents\Mircoarray von Rho.txt
2015-02-01 01:03 - 2015-02-01 21:04 - 00025184 _____ () C:\Users\Jane\Desktop\Pathways Migration Neurosphären 110614.xlsx
2015-01-31 10:13 - 2015-01-31 10:13 - 00000000 ____D () C:\Users\Jane\Tracing
2015-01-31 10:08 - 2015-01-31 10:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-01-31 10:05 - 2015-01-31 10:05 - 46882112 _____ (Dropbox, Inc.) C:\Users\Jane\Downloads\Dropbox 3.0.5.exe
2015-01-31 10:02 - 2015-01-28 09:44 - 01548384 _____ (Skype Technologies S.A.) C:\Users\Jane\Downloads\SkypeSetup.exe
2015-01-30 21:04 - 2015-02-04 14:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-29 17:45 - 2015-01-29 17:45 - 00120688 _____ () C:\Users\Jane\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-27 04:32 - 2015-01-28 11:27 - 00000000 ____D () C:\Users\Jane\Desktop\alte Sachen
2015-01-26 17:36 - 2015-01-27 10:02 - 00000000 ____D () C:\Users\Jane\Desktop\Vortrag heute
2015-01-26 11:03 - 2015-01-31 10:08 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-01-14 08:39 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 08:39 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 08:39 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 08:39 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 08:39 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 08:38 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 08:38 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 08:38 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 08:38 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 08:38 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 08:38 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 08:38 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 08:38 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-13 22:51 - 2015-01-14 08:48 - 00000000 ____D () C:\Users\Jane\AppData\Local\Box Sync
2015-01-13 22:48 - 2015-01-13 22:51 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-13 22:43 - 2015-01-13 22:43 - 25790720 _____ (Box Inc.) C:\Users\Jane\Downloads\BoxSyncSetup.exe
2015-01-12 13:30 - 2015-02-07 19:11 - 00000000 ____D () C:\Users\Jane\Desktop\Neue Lit Masterarbeit
2015-01-11 11:31 - 2015-01-31 09:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SiSoftware
2015-01-11 11:31 - 2015-01-11 11:31 - 00000000 ____D () C:\Program Files\SiSoftware
2015-01-11 11:31 - 2014-11-26 06:30 - 14368768 _____ () C:\Users\Jane\AppData\Roaming\Sandra.mdb
2015-01-11 11:21 - 2015-01-11 11:21 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1
2015-01-11 10:59 - 2015-01-11 10:59 - 00000000 ____D () C:\Windows\en
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\fi
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\es
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\el
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\de
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\da
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\cs
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\bg
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\ar
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\ro
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\pl
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\nl
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\it
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\hu
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\hr
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\he
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\fr
2015-01-11 10:55 - 2015-01-11 10:55 - 00001269 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\tr
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\th
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\sv
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\sl
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\sk
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\ru
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\ca
2015-01-11 10:54 - 2015-01-11 10:54 - 00001338 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2015-01-11 10:32 - 2014-03-31 21:06 - 00058056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fssfltr.sys
2015-01-11 10:31 - 2015-01-11 10:32 - 00000000 ____D () C:\Program Files\Windows Live
2015-01-11 10:23 - 2014-04-17 12:38 - 01239752 _____ (Microsoft Corporation) C:\Users\Jane\Downloads\wlsetup-web.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-08 10:50 - 2015-01-03 20:26 - 00000000 ____D () C:\FRST
2015-02-08 10:37 - 2014-05-02 15:36 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-08 10:30 - 2012-01-07 08:40 - 00000384 _____ () C:\Windows\Tasks\Acer Registration - Data Sending task.job
2015-02-08 10:25 - 2012-04-13 07:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-08 10:24 - 2012-01-07 10:17 - 00000000 ____D () C:\Users\Jane\AppData\Roaming\Skype
2015-02-08 02:43 - 2012-01-05 12:52 - 01118538 _____ () C:\Windows\WindowsUpdate.log
2015-02-07 20:44 - 2012-01-23 16:33 - 00000000 ____D () C:\Users\Jane\AppData\Local\FreePDF_XP
2015-02-07 10:50 - 2009-07-14 05:45 - 00024656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-07 10:50 - 2009-07-14 05:45 - 00024656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-06 12:13 - 2013-10-26 19:33 - 03649536 ___SH () C:\Users\Jane\Desktop\Thumbs.db
2015-02-05 16:31 - 2014-08-15 09:51 - 00000000 ____D () C:\Users\Jane\AppData\Local\Adobe
2015-02-05 16:30 - 2012-04-13 07:24 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 16:30 - 2012-04-13 07:24 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-05 16:30 - 2012-01-07 11:08 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-04 20:59 - 2012-12-15 19:07 - 00131072 _____ () C:\Windows\system32\Ikeext.etl
2015-02-04 20:59 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-04 20:59 - 2009-07-14 05:51 - 00195635 _____ () C:\Windows\setupact.log
2015-02-04 14:02 - 2012-12-15 18:25 - 00006424 _____ () C:\Users\Jane\ovpntray.log
2015-02-04 14:02 - 2012-01-07 08:31 - 00000000 ____D () C:\Users\Jane
2015-02-04 14:01 - 2012-04-26 14:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-04 14:01 - 2010-11-21 04:47 - 02500824 _____ () C:\Windows\PFRO.log
2015-02-04 10:13 - 2014-07-11 19:27 - 01052672 ___SH () C:\Users\Jane\Downloads\Thumbs.db
2015-02-03 21:10 - 2014-11-02 20:59 - 00003848 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1383253405
2015-02-03 21:10 - 2013-10-31 22:03 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-02 18:49 - 2014-04-28 09:30 - 00000000 __RHD () C:\MSOCache
2015-02-01 22:32 - 2012-01-07 10:09 - 00002062 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2015-01-31 15:37 - 2014-10-13 22:58 - 00000000 ____D () C:\Users\Jane\Desktop\IVJ-Themen
2015-01-31 10:08 - 2011-08-25 14:23 - 00000000 ____D () C:\ProgramData\Skype
2015-01-28 14:29 - 2012-01-07 10:22 - 00000000 ____D () C:\Users\Jane\AppData\Roaming\Wise Disk Cleaner
2015-01-26 11:03 - 2011-08-25 15:12 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2015-01-22 13:27 - 2014-10-09 20:45 - 00000000 ____D () C:\Users\Jane\Desktop\Neuroartikel
2015-01-16 20:43 - 2011-08-25 14:08 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-16 20:37 - 2013-06-04 16:40 - 00000000 ____D () C:\Users\Jane\AppData\Local\Apps\2.0
2015-01-15 00:05 - 2013-08-15 07:00 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-15 00:00 - 2012-01-07 10:40 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-12 08:03 - 2009-07-14 05:45 - 00466480 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-11 13:34 - 2013-09-11 17:18 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2015-01-11 11:15 - 2012-01-07 10:09 - 00000000 ____D () C:\Users\Jane\AppData\Local\Thunderbird
2015-01-11 10:57 - 2011-08-25 15:25 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2015-01-11 10:46 - 2011-08-25 15:12 - 00001422 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2015-01-11 10:29 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-01-11 10:27 - 2011-08-25 15:08 - 00159353 _____ () C:\Windows\DirectX.log
2015-01-11 10:24 - 2012-01-07 08:31 - 00000000 ____D () C:\Users\Jane\AppData\Local\Windows Live
2015-01-09 12:29 - 2014-06-15 11:55 - 00000000 ____D () C:\Users\Jane\Desktop\Tiermodelle

==================== Files in the root of some directories =======

2015-01-11 11:31 - 2014-11-26 06:30 - 14368768 _____ () C:\Users\Jane\AppData\Roaming\Sandra.mdb
2013-01-09 14:33 - 2015-01-05 15:43 - 0004608 _____ () C:\Users\Jane\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-08-25 14:23 - 2010-03-02 22:59 - 0131984 _____ () C:\ProgramData\FullRemove.exe

Some content of TEMP:
====================
C:\Users\Jane\AppData\Local\Temp\avgnt.exe
C:\Users\Jane\AppData\Local\Temp\SkypeSetup.exe

==================== Bamital & volsnap Check =================

schrauber · 08.02.2015, 11:13

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

FRST.txt ist nicht komplett, Addition.txt fehlt

Lucia001 · 08.02.2015, 11:32

Hallo Schrauber,

danke für die Nachricht.

Hier ist noch mal das FRST-File und das Addition-File, ich hoffe, diesmal in der richtigen Formatierung. Malwarebites hat nichts gefunden.

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2015
Ran by Jane (administrator) on STUART on 08-02-2015 11:23:01
Running from D:\Jane\Privat\Computersicherheit
Loaded Profiles: Jane &  (Available profiles: Jane)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(FileOpen Systems Inc.) C:\Program Files\FileOpen\Services\FileOpenManagerService64.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Aladdin Knowledge Systems Ltd.) C:\Windows\System32\hasplms.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\ProgramData\MobileBrServ\mbbService.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NTI, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
() C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\capiws.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(FileOpen Systems Inc.) C:\Program Files\FileOpen\Services\FileOpenBroker64.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 15\SteganosBrowserMonitor.exe
(FileHippo.com) C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Nokia\Nokia Internet Modem\NokiaInternetModem_AppStart.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 15\SteganosHotKeyService.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 15\fredirstarter.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\winword.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\excel.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-29] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324608 2010-06-10] (Alcor Micro Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860040 2011-01-05] (Acer Incorporated)
HKLM\...\Run: [FileOpenBroker] => C:\Program Files\FileOpen\Services\FileOpenBroker64.exe [1092528 2012-10-17] (FileOpen Systems Inc.)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] => C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-09-18] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisUpdate] => C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-09-18] (Egis Technology Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [340336 2010-09-28] (Egis Technology Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-11] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [NokiaInternetModem_AppStart.exe] => C:\Program Files (x86)\Nokia\Nokia Internet Modem\NokiaInternetModem.exe [138368 2011-12-02] (Nokia)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [134624 2014-07-23] (Check Point Software Technologies Ltd.)
HKLM-x32\...\Run: [Steganos HotKeys] => C:\Program Files (x86)\Steganos Safe 15\SteganosHotKeyService.exe [99840 2013-09-24] (Steganos Software GmbH)
HKLM-x32\...\Run: [SAFE15 File Redirection Starter] => C:\Program Files (x86)\Steganos Safe 15\fredirstarter.exe [17408 2014-02-21] (Steganos Software GmbH)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2010-11-26] (Acresso Corporation)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\Run: [SAFE15 Browser Monitor] => C:\Program Files (x86)\Steganos Safe 15\SteganosBrowserMonitor.exe [70656 2014-02-21] (Steganos Software GmbH)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [695808 2014-09-10] (FileHippo.com)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2010-11-26] (Acresso Corporation)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [SAFE15 Browser Monitor] => C:\Program Files (x86)\Steganos Safe 15\SteganosBrowserMonitor.exe [70656 2014-02-21] (Steganos Software GmbH)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [695808 2014-09-10] (FileHippo.com)
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2358124735-2455735417-86444415-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2358124735-2455735417-86444415-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{8BF89013-52EF-4306-AFD1-0F8F6B795861}: [NameServer] 139.7.30.125 139.7.30.126

FireFox:
========
FF ProfilePath: C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030
FF Homepage: hxxp://www.christianehohensee.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @cdisys.com/SafeView -> C:\Program Files (x86)\SafeView\npsfvw.dll (C.D.I. Systems (1992) Ltd.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\searchplugins\webde-suche.xml
FF Extension: NoScript - C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-10-08]
FF Extension: Adblock Plus - C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-03]
FF Extension: DownThemAll! - C:\Users\Jane\AppData\Roaming\Mozilla\Firefox\Profiles\clxpk72i.default-1381239029030\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2013-10-08]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-30]
FF HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

Chrome: 
=======
CHR Profile: C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-04-20]
CHR Extension: (Google Drive) - C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-04-20]
CHR Extension: (YouTube) - C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-20]
CHR Extension: (Google Search) - C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-20]
CHR Extension: (Chrome In-App Payments service) - C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-03]
CHR Extension: (Gmail) - C:\Users\Jane\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-20]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
R2 FileOpenManagerService; C:\Program Files\FileOpen\Services\FileOpenManagerService64.exe [335288 2012-10-17] (FileOpen Systems Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] ()
R2 NTISchedulerSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144640 2010-04-17] (NTI, Inc.)
R2 OpenVPNAccessClient; C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\capiws.exe [24064 2012-10-12] () [File not signed]
S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [38200 2014-12-01] (The OpenVPN Project)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015i\RpcAgentSrv.exe [73200 2014-12-17] (SiSoftware) [File not signed]
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [3596240 2014-07-23] (Check Point Software Technologies Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZaPrivacyService.exe [93712 2014-07-03] (Check Point Software Technologies, Ltd.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
S3 nokia_usb_modem_cdc_acm; C:\Windows\System32\DRIVERS\nokia_usb_modem_cdc_acm.sys [79872 2011-06-22] (Nokia)
S3 nokia_usb_modem_cdc_ecm; C:\Windows\System32\DRIVERS\nokia_usb_modem_cdc_ecm.sys [58880 2011-06-22] (Nokia)
S3 nokia_usb_modem_cpo; C:\Windows\System32\DRIVERS\nokia_usb_modem_cpo.sys [14336 2011-06-22] (Nokia)
S3 nokia_usb_modem_ecm_enum; C:\Windows\System32\DRIVERS\nokia_usb_modem_ecm_enum.sys [56320 2011-06-22] (Nokia)
S3 nokia_usb_modem_ecm_enum_filter; C:\Windows\System32\DRIVERS\nokia_usb_modem_ecm_enum_filter.sys [56320 2011-06-22] (Nokia)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-08-16] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-08-16] ()
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015i\WNt600x64\Sandra.sys [23112 2009-08-07] (SiSoftware)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2014-01-30] (Softwareentwicklung Remus - ArchiCrypt - )
R3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450456 2014-07-22] (Check Point Software Technologies Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-04 10:20 - 2015-02-04 10:20 - 00000093 _____ () C:\Windows\wininit.ini
2015-02-03 14:00 - 2015-02-04 09:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-02-03 11:47 - 2015-02-03 11:48 - 00237056 _____ () C:\Users\Jane\Desktop\STUNDEN2015-CH.xls
2015-02-01 22:27 - 2014-11-11 11:33 - 31389440 _____ (Mozilla) C:\Users\Jane\Downloads\Thunderbird Setup 34.0b1.exe
2015-02-01 19:48 - 2015-02-01 21:04 - 00007868 _____ () C:\Users\Jane\Desktop\Mircoarray-Überprüfungen der Pathways.txt
2015-02-01 06:46 - 2015-02-01 06:46 - 00000830 _____ () C:\Users\Jane\Documents\Mircoarray von Rho.txt
2015-02-01 01:03 - 2015-02-01 21:04 - 00025184 _____ () C:\Users\Jane\Desktop\Pathways Migration Neurosphären 110614.xlsx
2015-01-31 10:13 - 2015-01-31 10:13 - 00000000 ____D () C:\Users\Jane\Tracing
2015-01-31 10:08 - 2015-01-31 10:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-01-31 10:05 - 2015-01-31 10:05 - 46882112 _____ (Dropbox, Inc.) C:\Users\Jane\Downloads\Dropbox 3.0.5.exe
2015-01-31 10:02 - 2015-01-28 09:44 - 01548384 _____ (Skype Technologies S.A.) C:\Users\Jane\Downloads\SkypeSetup.exe
2015-01-30 21:04 - 2015-02-04 14:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-29 17:45 - 2015-01-29 17:45 - 00120688 _____ () C:\Users\Jane\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-27 04:32 - 2015-01-28 11:27 - 00000000 ____D () C:\Users\Jane\Desktop\alte Sachen
2015-01-26 17:36 - 2015-01-27 10:02 - 00000000 ____D () C:\Users\Jane\Desktop\Vortrag heute
2015-01-26 11:03 - 2015-01-31 10:08 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-01-14 08:39 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 08:39 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 08:39 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 08:39 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 08:39 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 08:38 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 08:38 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 08:38 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 08:38 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 08:38 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 08:38 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 08:38 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 08:38 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-13 22:51 - 2015-01-14 08:48 - 00000000 ____D () C:\Users\Jane\AppData\Local\Box Sync
2015-01-13 22:48 - 2015-01-13 22:51 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-13 22:43 - 2015-01-13 22:43 - 25790720 _____ (Box Inc.) C:\Users\Jane\Downloads\BoxSyncSetup.exe
2015-01-12 13:30 - 2015-02-07 19:11 - 00000000 ____D () C:\Users\Jane\Desktop\Neue Lit Masterarbeit
2015-01-11 11:31 - 2015-01-31 09:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SiSoftware
2015-01-11 11:31 - 2015-01-11 11:31 - 00000000 ____D () C:\Program Files\SiSoftware
2015-01-11 11:31 - 2014-11-26 06:30 - 14368768 _____ () C:\Users\Jane\AppData\Roaming\Sandra.mdb
2015-01-11 11:21 - 2015-01-11 11:21 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1
2015-01-11 10:59 - 2015-01-11 10:59 - 00000000 ____D () C:\Windows\en
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\fi
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\es
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\el
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\de
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\da
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\cs
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\bg
2015-01-11 10:57 - 2015-01-11 10:57 - 00000000 ____D () C:\Windows\ar
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\ro
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\pl
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\nl
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\it
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\hu
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\hr
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\he
2015-01-11 10:56 - 2015-01-11 10:56 - 00000000 ____D () C:\Windows\fr
2015-01-11 10:55 - 2015-01-11 10:55 - 00001269 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\tr
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\th
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\sv
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\sl
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\sk
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\ru
2015-01-11 10:55 - 2015-01-11 10:55 - 00000000 ____D () C:\Windows\ca
2015-01-11 10:54 - 2015-01-11 10:54 - 00001338 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2015-01-11 10:32 - 2014-03-31 21:06 - 00058056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fssfltr.sys
2015-01-11 10:31 - 2015-01-11 10:32 - 00000000 ____D () C:\Program Files\Windows Live
2015-01-11 10:23 - 2014-04-17 12:38 - 01239752 _____ (Microsoft Corporation) C:\Users\Jane\Downloads\wlsetup-web.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-08 11:23 - 2015-01-03 20:26 - 00000000 ____D () C:\FRST
2015-02-08 11:20 - 2012-01-07 10:17 - 00000000 ____D () C:\Users\Jane\AppData\Roaming\Skype
2015-02-08 11:00 - 2012-01-07 08:40 - 00000384 _____ () C:\Windows\Tasks\Acer Registration - Data Sending task.job
2015-02-08 10:37 - 2014-05-02 15:36 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-08 10:25 - 2012-04-13 07:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-08 10:17 - 2012-01-05 12:52 - 01118538 _____ () C:\Windows\WindowsUpdate.log
2015-02-07 20:44 - 2012-01-23 16:33 - 00000000 ____D () C:\Users\Jane\AppData\Local\FreePDF_XP
2015-02-07 10:50 - 2009-07-14 05:45 - 00024656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-07 10:50 - 2009-07-14 05:45 - 00024656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-06 12:13 - 2013-10-26 19:33 - 03649536 ___SH () C:\Users\Jane\Desktop\Thumbs.db
2015-02-05 16:31 - 2014-08-15 09:51 - 00000000 ____D () C:\Users\Jane\AppData\Local\Adobe
2015-02-05 16:30 - 2012-04-13 07:24 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 16:30 - 2012-04-13 07:24 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-05 16:30 - 2012-01-07 11:08 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-04 20:59 - 2012-12-15 19:07 - 00131072 _____ () C:\Windows\system32\Ikeext.etl
2015-02-04 20:59 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-04 20:59 - 2009-07-14 05:51 - 00195635 _____ () C:\Windows\setupact.log
2015-02-04 14:02 - 2012-12-15 18:25 - 00006424 _____ () C:\Users\Jane\ovpntray.log
2015-02-04 14:02 - 2012-01-07 08:31 - 00000000 ____D () C:\Users\Jane
2015-02-04 14:01 - 2012-04-26 14:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-04 14:01 - 2010-11-21 04:47 - 02500824 _____ () C:\Windows\PFRO.log
2015-02-04 10:13 - 2014-07-11 19:27 - 01052672 ___SH () C:\Users\Jane\Downloads\Thumbs.db
2015-02-03 21:10 - 2014-11-02 20:59 - 00003848 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1383253405
2015-02-03 21:10 - 2013-10-31 22:03 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-02 18:49 - 2014-04-28 09:30 - 00000000 __RHD () C:\MSOCache
2015-02-01 22:32 - 2012-01-07 10:09 - 00002062 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2015-01-31 15:37 - 2014-10-13 22:58 - 00000000 ____D () C:\Users\Jane\Desktop\IVJ-Themen
2015-01-31 10:08 - 2011-08-25 14:23 - 00000000 ____D () C:\ProgramData\Skype
2015-01-28 14:29 - 2012-01-07 10:22 - 00000000 ____D () C:\Users\Jane\AppData\Roaming\Wise Disk Cleaner
2015-01-26 11:03 - 2011-08-25 15:12 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2015-01-22 13:27 - 2014-10-09 20:45 - 00000000 ____D () C:\Users\Jane\Desktop\Neuroartikel
2015-01-16 20:43 - 2011-08-25 14:08 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-16 20:37 - 2013-06-04 16:40 - 00000000 ____D () C:\Users\Jane\AppData\Local\Apps\2.0
2015-01-15 00:05 - 2013-08-15 07:00 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-15 00:00 - 2012-01-07 10:40 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-12 08:03 - 2009-07-14 05:45 - 00466480 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-11 13:34 - 2013-09-11 17:18 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2015-01-11 11:15 - 2012-01-07 10:09 - 00000000 ____D () C:\Users\Jane\AppData\Local\Thunderbird
2015-01-11 10:57 - 2011-08-25 15:25 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2015-01-11 10:46 - 2011-08-25 15:12 - 00001422 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2015-01-11 10:29 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-01-11 10:27 - 2011-08-25 15:08 - 00159353 _____ () C:\Windows\DirectX.log
2015-01-11 10:24 - 2012-01-07 08:31 - 00000000 ____D () C:\Users\Jane\AppData\Local\Windows Live
2015-01-09 12:29 - 2014-06-15 11:55 - 00000000 ____D () C:\Users\Jane\Desktop\Tiermodelle

==================== Files in the root of some directories =======

2015-01-11 11:31 - 2014-11-26 06:30 - 14368768 _____ () C:\Users\Jane\AppData\Roaming\Sandra.mdb
2013-01-09 14:33 - 2015-01-05 15:43 - 0004608 _____ () C:\Users\Jane\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-08-25 14:23 - 2010-03-02 22:59 - 0131984 _____ () C:\ProgramData\FullRemove.exe

Some content of TEMP:
====================
C:\Users\Jane\AppData\Local\Temp\avgnt.exe
C:\Users\Jane\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 17:12

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-02-2015
Ran by Jane at 2015-02-08 11:24:28
Running from D:\Jane\Privat\Computersicherheit
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ZoneAlarm Free Firewall Firewall (Enabled) {1B8D532F-88B1-B2AD-ED22-AED92687A1D2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.68 - NewTech Infosystems)
Acer Crystal Eye Webcam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1424 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.0.1424 - CyberLink Corp.) Hidden
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 5.00.3009 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3016 - Acer Incorporated)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.03.3004 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.1124.2010 - Acer Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{DD89CE29-BC88-40C6-A845-E2548682C5D6}) (Version: 1.9.17.06019 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.9.17.06019 - Alcor Micro Corp.) Hidden
ATI Catalyst Install Manager (HKLM\...\{75FDB05A-C1C2-CD17-35CE-3C1A454CC79F}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
Autostartmanager 1.45 (HKLM-x32\...\Autostartmanager) (Version:  - )
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
AVM FRITZ!Box Dokumentation (HKLM-x32\...\AVMFBox) (Version:  - AVM Berlin)
AVM FRITZ!Box Druckeranschluss (HKLM-x32\...\AVMFBoxPrinter) (Version:  - AVM Berlin)
Backup Manager Basic (x32 Version: 2.0.0.68 - NewTech Infosystems) Hidden
Box Sync (x32 Version: 4.0.5955.0 - Box Inc.) Hidden
Broadcom Gigabit NetLink Controller (HKLM\...\{A84DB02B-9C2B-4272-9D2D-A80E00A56513}) (Version: 14.2.4.2 - Broadcom Corporation)
Carl Zeiss AxioVision SE64 Rel. 4.9.1 (HKLM\...\{F927FC22-CD4E-477D-80BA-D63F5F75ED64}) (Version: 4.9.1.1 - Carl Zeiss Microscopy GmbH)
ccc-core-static (x32 Version: 2010.0825.2205.37769 - Ihr Firmenname) Hidden
CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.3817.50 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\Dropbox) (Version: 1.4.9 - Dropbox, Inc.)
Dropbox (HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Dropbox) (Version: 1.4.9 - Dropbox, Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 13.3.0.9066 - Landesfinanzdirektion Thüringen)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON SX125 Series Printer Uninstall (HKLM\...\EPSON SX125 Series) (Version:  - SEIKO EPSON Corporation)
FileHippo.com Update Checker (HKLM-x32\...\FileHippo.com) (Version:  - )
FileOpen Client version B925 (HKLM\...\FileOpenClient_is1) (Version: B925 - FileOpen Systems, Inc.)
Flowing Software 2 (HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\3dbebd91f2be059f) (Version: 2.5.0.0 - Flowing Software 2)
Flowing Software 2 (HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\3dbebd91f2be059f) (Version: 2.5.0.0 - Flowing Software 2)
Fotogaléria (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fotogalleri (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fotogalleriet (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fotoğraf Galerisi (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version:  - )
Galeria de Fotografias (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galeria de Fotos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galeria fotogràfica (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galeria fotografii (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galerie foto (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galerija fotografija (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.04) (Version: 9.04 - Artifex Software Inc.)
GraphPad Prism 6 (HKLM-x32\...\{606443B0-9831-11DC-5F90-015CFB7A6952}) (Version: 6.05 - GraphPad Software)
IBM SPSS Statistics 21 (HKLM\...\{1E26B9C2-ED08-4EEA-83C8-A786502B41E5}) (Version: 21.0.0.0 - IBM Corp)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3006 - Acer Incorporated)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Medikamente und Schadstoffe V 1.1 (HKLM-x32\...\{4A4622D4-86D6-4D27-8396-9187D1EBD604}) (Version: 1.1 - Spitta Verlag GmbH & Co. KG)
Mendeley Desktop 1.12.1 (HKLM-x32\...\Mendeley Desktop) (Version: 1.12.1 - Mendeley Ltd.)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft MapPoint Europa 2010 (HKLM-x32\...\{C82185E8-C27B-4EF4-2010-2222BC2C2B6D}) (Version: 17.0.22.0600 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2358124735-2455735417-86444415-1000\...\OneDriveSetup.exe) (Version: 17.0.4041.0512 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\OneDriveSetup.exe) (Version: 17.0.4041.0512 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Core Components (x64) ENU  (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Provider Services (x64) ENU  (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.14.00.03 - Huawei Technologies Co.,Ltd)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 36.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 en-US)) (Version: 36.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0 - Mozilla)
Mozilla Thunderbird 34.0 (x86 en-US) (HKLM-x32\...\Mozilla Thunderbird 34.0 (x86 en-US)) (Version: 34.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyWinLocker (Version: 4.0.14.11 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.11 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.11 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.11 - Egis Technology Inc.) Hidden
Nokia Internet Modem (HKLM-x32\...\{5FEFEB99-285E-43B2-A6C6-9432A42A1EF3}) (Version: 1.3.283.3 - SmartCom)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.3 - Notepad++ Team)
NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.630 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.630 - NewTech Infosystems) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
OpenOffice 4.1.1 (HKLM-x32\...\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
OpenVPN 2.3.6-I001  (HKLM\...\OpenVPN) (Version: 2.3.6-I001 - )
Opera Stable 27.0.1689.66 (HKLM-x32\...\Opera 27.0.1689.66) (Version: 27.0.1689.66 - Opera Software ASA)
Poczta usługi Windows Live (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Pošta Windows Live (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
R for Windows 3.0.0 (HKLM\...\R for Windows 3.0.0_is1) (Version: 3.0.0 - R Core Team)
Raccolta foto (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6167 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
ResonateMP4 Tools (HKLM-x32\...\ResonateMP4) (Version: 0.9.1 - ResonateMP4)
Revo Uninstaller 1.92 (HKLM-x32\...\Revo Uninstaller) (Version: 1.92 - VS Revo Group)
RStudio (HKLM-x32\...\RStudio) (Version: 0.97.449 - RStudio)
SafeView plugin (build 4.5.502) (HKLM-x32\...\SafeView) (Version:  - CDI Systems (1992) Ltd.)
Shredder (Version: 2.0.8.7 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.7 - Egis Technology Inc.) Hidden
SiSoftware Sandra Lite 2015x (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2496}_is1) (Version: 21.15.2015.1 - SiSoftware)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
Steganos Safe 15 (HKLM-x32\...\{D3FB0B73-11DF-41EE-9B6D-C7198079A88E}) (Version: 15.2.1 - Steganos Software GmbH)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.6.0 - Synaptics Incorporated)
SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.20768 - TeamViewer)
TOEFL Official Guide 4.0 (HKLM-x32\...\TOEFL Official Guide) (Version: 4.0 - McGraw-Hill)
Valokuvavalikoima (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
VC 9.0 Runtime (x32 Version: 1.0.0 - Check Point Software Technologies Ltd) Hidden
Visual C++ 9.0 Runtime for Dragon NaturallySpeaking 64bit (x64) (HKLM\...\{4A5A427F-BA39-4BF0-7777-9A47FBE60C9F}) (Version: 11.0.200 - Nuance Communications Inc.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows-Treiberpaket - Carl Zeiss Microscopy GmbH (tvmcam) Image  (04/30/2011 9.2.0.0) (HKLM\...\4B1A19641FF6C68E6C4968D20DC7DDD950F259CF) (Version: 04/30/2011 9.2.0.0 - Carl Zeiss Microscopy GmbH)
Windows-Treiberpaket - Carl Zeiss Microscopy GmbH (usbzss) ZeissCanNode  (06/15/2012 1.0.0.0) (HKLM\...\4EEE4AC06A5B0B2ECC96AAA8AD8BF74B49F5D2C9) (Version: 06/15/2012 1.0.0.0 - Carl Zeiss Microscopy GmbH)
Windows-Treiberpaket - Thesycon (cdcacmpo) Ports  (02/28/2009 1.81.0.0) (HKLM\...\8FCBBF470CAE82569BE9464982905411ACC5927F) (Version: 02/28/2009 1.81.0.0 - Thesycon)
Winmail Opener 1.4 (HKLM-x32\...\Winmail Opener) (Version: 1.4 - Eolsoft)
WinRAR 5.10 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
Wise Disk Cleaner 8.39 (HKLM-x32\...\Wise Disk Cleaner_is1) (Version: 8.39 - WiseCleaner.com, Inc.)
ZoneAlarm Do Not Track Add-on 2.2.5.1213 (HKLM-x32\...\ZoneAlarm Do Not Track Add-on_is1) (Version: 2.2.5.1213 - Abine)
ZoneAlarm Firewall (x32 Version: 13.3.052.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Free Firewall (HKLM-x32\...\ZoneAlarm Free Firewall) (Version: 13.3.052.000 - Check Point)
ZoneAlarm Security (x32 Version: 13.3.052.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Security Toolbar  (HKLM-x32\...\zonealarm) (Version: 1.8.29.17 - Check Point Software Technologies LTD)
Συλλογή φωτογραφιών (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 16.4.3528.0331 - Корпорация Майкрософт) Hidden
Фотоальбом (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Фотогалерия (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Фотографии (общедоступная версия) (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
גלריית התמונות (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
معرض الصور (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
影像中心 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2358124735-2455735417-86444415-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jane\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2358124735-2455735417-86444415-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Jane\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2358124735-2455735417-86444415-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Jane\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2358124735-2455735417-86444415-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Jane\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2358124735-2455735417-86444415-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Jane\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2358124735-2455735417-86444415-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Jane\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2358124735-2455735417-86444415-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2358124735-2455735417-86444415-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2358124735-2455735417-86444415-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2358124735-2455735417-86444415-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)

==================== Restore Points  =========================

31-01-2015 09:52:59 SiSoftware Sandra Lite
03-02-2015 10:55:08 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2015-01-02 17:11 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {12D4E037-5C36-4931-B9CF-CFF04DD87F77} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)
Task: {13B030C6-BD6F-4E8E-B6CD-A1F73AA8F66C} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {2C635775-49F4-4960-95EC-808F137D9CFB} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {439583DD-20EC-4983-AA61-7CFBDD0AEBC5} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {494A5E8B-ED30-44D0-8BB5-B7997EA6B476} - System32\Tasks\{969B9965-5BDE-4610-B7E5-4191316F9870} => pcalua.exe -a C:\Users\Jane\Downloads\SpyHunter-Installer.exe -d C:\Users\Jane\Downloads
Task: {600AB013-9477-437D-9439-8FFEF5D28987} - System32\Tasks\Microsoft_Hardware_Launch_devicecenter_exe => C:\Program Files\Microsoft Device Center\devicecenter.exe
Task: {61C702A5-455E-45F7-B860-AEE9DC3735C9} - System32\Tasks\{7382FB95-04A2-4DFB-8EFB-5A1853E19D0F} => pcalua.exe -a "D:\Prism 4\GraphPad.Prism.4.0-DRX\GraphPad.Prism.4.0-DRX\install.exe" -d "D:\Prism 4\GraphPad.Prism.4.0-DRX\GraphPad.Prism.4.0-DRX"
Task: {8786BB55-87C2-47E3-8A68-4491E507EF07} - System32\Tasks\{3C242610-1788-43A9-BC70-AB7F49AF3C3C} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-06-14] (Dropbox, Inc.)
Task: {904619FC-C105-4B76-8219-23518543128E} - System32\Tasks\Acer Registration - Data Sending task => C:\Program Files (x86)\Acer\Registration\GREG.exe [2011-01-25] (Acer Incorporated)
Task: {98339ABD-0115-4012-B38E-B21CCAA0CC56} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {9B80BBB0-D0EB-4C71-B10F-01CBFD487C48} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-11-12] (Microsoft Corporation)
Task: {AB4907E9-E299-4044-96F2-8D1B9F2FF2F4} - System32\Tasks\Opera scheduled Autoupdate 1383253405 => C:\Program Files (x86)\Opera\launcher.exe [2015-02-02] (Opera Software)
Task: {AFA885A5-91AE-473F-A53A-05078994E836} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {C8087A44-A313-48E7-BADE-B941C5C2F86A} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {C810C722-BAF5-4DDE-BC32-7D0D37165150} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {F8CA4D76-4B30-4D1C-BC85-D288FDB7E97F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {FB5C420F-25D9-4AF2-9E85-5DDEB51B08B6} - System32\Tasks\{4BA103A1-B9AC-4044-9981-F899A7F8D3C6} => C:\Users\Jane\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-06-14] (Dropbox, Inc.)
Task: {FF25216C-F83E-4F5B-A77C-E18EC8ADE3CB} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {FF898D61-103A-486B-8414-1872FD3FFA96} - System32\Tasks\SuperEasyDriverUpdaterRunAtStartup => C:\Program Files (x86)\SuperEasy Software\Driver Updater\supereasydu.exe
Task: C:\Windows\Tasks\Acer Registration - Data Sending task.job => C:\Program Files (x86)\Acer\Registration\GREG.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) ==============

2012-01-07 13:53 - 2010-06-17 21:56 - 00087040 _____ () C:\Windows\System32\redmonnt.dll
2014-04-27 21:01 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-04-01 14:57 - 2012-03-12 10:05 - 00232288 _____ () C:\ProgramData\MobileBrServ\mbbservice.exe
2012-10-12 08:25 - 2012-10-12 08:25 - 00024064 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\capiws.exe
2010-11-17 15:00 - 2010-11-17 15:00 - 00220672 _____ () C:\Program Files (x86)\Steganos Safe 15\ShellExtension.dll
2009-01-22 00:45 - 2009-01-22 00:45 - 01401856 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll
2014-05-12 10:49 - 2014-05-12 10:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2011-12-02 10:31 - 2011-12-02 10:31 - 00142464 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\NokiaInternetModem_AppStart.exe
2010-06-28 23:20 - 2010-06-28 23:20 - 00465576 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2010-06-28 23:12 - 2010-06-28 23:12 - 01081600 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll
2012-02-07 11:11 - 2012-02-07 11:11 - 00027648 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\servicemanager.pyd
2012-02-07 11:09 - 2012-02-07 11:09 - 00110080 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\pywintypes26.dll
2012-02-07 11:11 - 2012-02-07 11:11 - 00042496 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\win32service.pyd
2012-02-07 11:11 - 2012-02-07 11:11 - 00098816 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\win32api.pyd
2010-08-24 18:48 - 2010-08-24 18:48 - 00153088 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\pyexpat.pyd
2010-08-24 18:47 - 2010-08-24 18:47 - 00040448 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\_socket.pyd
2010-08-24 18:48 - 2010-08-24 18:48 - 00720896 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\_ssl.pyd
2012-09-27 21:46 - 2012-09-27 21:46 - 00019968 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\zope.interface._zope_interface_coptimizations.pyd
2010-08-24 18:48 - 2010-08-24 18:48 - 00286208 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\_hashlib.pyd
2010-08-24 18:48 - 2010-08-24 18:48 - 00073728 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\_ctypes.pyd
2010-08-24 18:48 - 2010-08-24 18:48 - 00011776 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\select.pyd
2012-09-27 21:47 - 2012-09-27 21:47 - 00010240 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\OpenSSL.rand.pyd
2012-09-27 21:47 - 2012-09-27 21:47 - 00061440 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\OpenSSL.crypto.pyd
2012-09-27 21:47 - 2012-09-27 21:47 - 00039424 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\OpenSSL.SSL.pyd
2012-02-07 11:10 - 2012-02-07 11:10 - 00035840 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\win32process.pyd
2012-09-27 21:46 - 2012-09-27 21:46 - 00007680 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\twisted.protocols._c_urlarg.pyd
2012-09-27 21:47 - 2012-09-27 21:47 - 00006656 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\pyovpnc.pyd
2012-02-07 11:13 - 2012-02-07 11:13 - 00358912 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\pythoncom26.dll
2012-02-07 11:16 - 2012-02-07 11:16 - 00266240 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\win32com.shell.shell.pyd
2012-02-07 11:10 - 2012-02-07 11:10 - 00111616 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\win32file.pyd
2012-02-07 11:10 - 2012-02-07 11:10 - 00108544 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\win32security.pyd
2012-02-07 11:10 - 2012-02-07 11:10 - 00018432 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\win32event.pyd
2012-02-07 11:10 - 2012-02-07 11:10 - 00024064 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\win32pipe.pyd
2012-02-07 11:11 - 2012-02-07 11:11 - 00022528 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\win32ts.pyd
2011-12-02 10:31 - 2011-12-02 10:31 - 00061872 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\DriveDetector.dll
2011-12-02 10:31 - 2011-12-02 10:31 - 00608688 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\Toolkit.dll
2011-12-02 10:31 - 2011-12-02 10:31 - 00147888 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\pcre3.dll
2011-12-02 10:31 - 2011-12-02 10:31 - 00861104 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\UIToolkit.dll
2011-12-02 10:31 - 2011-12-02 10:31 - 00395184 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\WebClient.dll
2011-12-02 10:31 - 2011-12-02 10:31 - 00096688 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\ComCore.dll
2011-12-02 10:31 - 2011-12-02 10:31 - 00049584 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\Preferences.dll
2011-12-02 10:31 - 2011-12-02 10:31 - 00247728 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\DB.dll
2011-12-02 10:31 - 2011-12-02 10:31 - 00132016 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\Discovery.dll
2011-12-02 10:31 - 2011-12-02 10:31 - 00360880 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\Device.dll
2011-12-02 10:31 - 2011-12-02 10:31 - 00033280 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\ressources\plugins\DiscoveryGeneric.plugin
2011-12-02 10:31 - 2011-12-02 10:31 - 00099760 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\System.dll
2011-12-02 10:31 - 2011-12-02 10:31 - 00028160 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\ressources\plugins\DiscoveryMobileBroadband.plugin
2011-12-02 10:31 - 2011-12-02 10:31 - 00018944 _____ () C:\Program Files (x86)\Nokia\Nokia Internet Modem\ressources\plugins\DiscoveryNdis.plugin
2012-09-23 19:43 - 2012-09-23 19:43 - 00313992 _____ () C:\Program Files (x86)\Adobe\Reader 11.0\Reader\sqlite.dll
2013-09-05 15:04 - 2013-09-05 15:04 - 14588632 _____ () C:\Program Files (x86)\Adobe\Reader 11.0\Reader\NPSWF32.dll
2014-06-19 22:43 - 2014-11-16 10:29 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
2015-02-03 14:00 - 2015-02-03 14:00 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2015-02-03 14:00 - 2015-02-03 14:00 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2015-02-03 14:00 - 2015-02-03 14:00 - 03717744 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:0FF263E8

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2358124735-2455735417-86444415-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Jane\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-2358124735-2455735417-86444415-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Jane\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Admin (S-1-5-21-2358124735-2455735417-86444415-1002 - Administrator - Enabled)
Administrator (S-1-5-21-2358124735-2455735417-86444415-500 - Administrator - Disabled)
Gast (S-1-5-21-2358124735-2455735417-86444415-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2358124735-2455735417-86444415-1004 - Limited - Enabled)
Jane (S-1-5-21-2358124735-2455735417-86444415-1000 - Administrator - Enabled) => C:\Users\Jane

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/08/2015 00:48:24 AM) (Source: DragonSvc) (EventID: 0) (User: )
Description: Error: Failed to initiate execution of 'NatSpeak Periodic Data Collection' task

Error: (02/07/2015 03:00:29 AM) (Source: DragonSvc) (EventID: 0) (User: )
Description: Error: Failed to initiate execution of 'NatSpeak Periodic Language Model Optimization' task

Error: (02/06/2015 03:46:47 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "x64" des "processorArchitecture"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (02/06/2015 03:00:08 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (02/06/2015 00:48:03 AM) (Source: DragonSvc) (EventID: 0) (User: )
Description: Error: Failed to initiate execution of 'NatSpeak Periodic Data Collection' task

Error: (02/05/2015 04:28:38 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/04/2015 09:01:08 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/04/2015 08:29:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 7.1.0.105 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 14bc

Startzeit: 01d040b05ae7a615

Endzeit: 60000

Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe

Berichts-ID: e9a19498-aca3-11e4-b29c-206a8a07c373

Error: (02/04/2015 04:10:01 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "x64" des "processorArchitecture"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (02/04/2015 02:28:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm firefox.exe, Version 36.0.0.5511 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1080

Startzeit: 01d0407c724d5c26

Endzeit: 16

Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID: 99fa74fd-ac71-11e4-b29c-206a8a07c373


System errors:
=============
Error: (02/04/2015 08:59:30 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎04.‎02.‎2015 um 20:58:00 unerwartet heruntergefahren.

Error: (02/04/2015 02:01:51 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎04.‎02.‎2015 um 13:59:09 unerwartet heruntergefahren.

Error: (02/03/2015 08:56:54 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ZAPrivacyService erreicht.

Error: (01/31/2015 09:54:46 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SANDRA" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (01/31/2015 00:44:51 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎31.‎01.‎2015 um 00:43:08 unerwartet heruntergefahren.

Error: (01/28/2015 01:33:27 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎28.‎01.‎2015 um 13:30:18 unerwartet heruntergefahren.

Error: (01/27/2015 05:56:19 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (01/27/2015 04:01:00 AM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{BB1A4305-A3AC-4C67-91FB-C0C9020BD9F1} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.

Error: (01/25/2015 11:02:44 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎25.‎01.‎2015 um 23:00:45 unerwartet heruntergefahren.

Error: (01/25/2015 02:24:42 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.


Microsoft Office Sessions:
=========================
Error: (02/08/2015 00:48:24 AM) (Source: DragonSvc) (EventID: 0) (User: )
Description: Error: Failed to initiate execution of 'NatSpeak Periodic Data Collection' task

Error: (02/07/2015 03:00:29 AM) (Source: DragonSvc) (EventID: 0) (User: )
Description: Error: Failed to initiate execution of 'NatSpeak Periodic Language Model Optimization' task

Error: (02/06/2015 03:46:47 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityprocessorArchitecturex64c:\program files\R\r-3.0.0\Tcl\bin64\tk85.dllc:\program files\R\r-3.0.0\Tcl\bin64\tk85.dll9

Error: (02/06/2015 03:00:08 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (02/06/2015 00:48:03 AM) (Source: DragonSvc) (EventID: 0) (User: )
Description: Error: Failed to initiate execution of 'NatSpeak Periodic Data Collection' task

Error: (02/05/2015 04:28:38 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jane\Downloads\esetsmartinstaller_deu.exe

Error: (02/04/2015 09:01:08 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/04/2015 08:29:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Skype.exe7.1.0.10514bc01d040b05ae7a61560000C:\Program Files (x86)\Skype\Phone\Skype.exee9a19498-aca3-11e4-b29c-206a8a07c373

Error: (02/04/2015 04:10:01 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityprocessorArchitecturex64c:\program files\R\r-3.0.0\Tcl\bin64\tk85.dllc:\program files\R\r-3.0.0\Tcl\bin64\tk85.dll9

Error: (02/04/2015 02:28:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: firefox.exe36.0.0.5511108001d0407c724d5c2616C:\Program Files (x86)\Mozilla Firefox\firefox.exe99fa74fd-ac71-11e4-b29c-206a8a07c373


CodeIntegrity Errors:
===================================
  Date: 2015-01-02 17:07:42.326
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-01-02 17:07:42.185
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-08-19 21:21:09.713
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-19 20:26:54.543
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-19 20:02:23.517
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-19 14:48:41.957
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-19 12:54:35.915
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-19 09:55:00.629
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-19 00:17:47.229
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-19 00:03:13.304
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3 CPU M 350 @ 2.27GHz
Percentage of memory in use: 63%
Total physical RAM: 3956.43 MB
Available physical RAM: 1428.93 MB
Total Pagefile: 7911.05 MB
Available Pagefile: 4069.98 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:224.87 GB) (Free:141.34 GB) NTFS
Drive d: (DATA) (Fixed) (Total:225.17 GB) (Free:106.36 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 5D35D69E)
Partition 1: (Not Active) - (Size=15.6 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=224.9 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=225.2 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 08.02.2015, 16:18

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

verstellte Internet-Suchfunktion

Plagegeister aller Art und deren Bekämpfung: verstellte Internet-Suchfunktion