Nach download von avc-577free.exe werde ich mit Pop-ups überschüttet

Corsipo · 15.02.2015, 20:08

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-02-2015
Ran by K L S K at 2015-02-15 20:06:02 Run:9
Running from C:\Users\WoJa\Desktop
Loaded Profiles: WoJa & K L S K (Available profiles: Wolfgang & WoJa & K L S K)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
REG: reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyOverride /f
REG: reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f
REG: reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v DefaultConnectionSettings /f
REG: reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v SavedLegacySettings /f
REG: reg add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
EmptyTemp:
         
*****************


========= reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyOverride /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v DefaultConnectionSettings /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v SavedLegacySettings /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========

EmptyTemp: => Removed 22.1 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 20:06:19 ====

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-02-2015
Ran by K L S K (administrator) on WOJA-WIN-8_PC on 15-02-2015 20:07:37
Running from C:\Users\WoJa\Desktop
Loaded Profiles: WoJa & K L S K (Available profiles: Wolfgang & WoJa & K L S K)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files (x86)\PHotkey\AsLdrSrv.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Ellora Assets Corp.) C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
(Microsoft Corporation) C:\Windows\System32\backgroundTaskHost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
() C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
() C:\Program Files (x86)\PHotkey\PVDesktop.exe
() C:\Program Files (x86)\PHotkey\PVDAgent.exe
(Pegatron Corporation) C:\Program Files (x86)\PHotkey\MyWiMax.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe
() C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
( ) C:\Windows\SysWOW64\lxebcoms.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\runonce.exe
(Dropbox, Inc.) C:\Users\WoJa\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\reader_sl.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files\Windows Sidebar\8GadgetPack.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\LocationNotifications.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] => C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [764032 2012-08-10] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [127616 2012-08-10] (Atheros Communications)
HKLM\...\Run: [lxebmon.exe] => C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe [772712 2013-01-23] ()
HKLM\...\Run: [EzPrint] => C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe [150264 2013-01-23] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2930488 2012-09-21] (Synaptics Incorporated)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [tvncontrol] => C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-11-19] (Intel Corporation)
HKLM-x32\...\Run: [ATLauncher] => C:\Program Files\McAfee\MSC\OOBE\ATLauncher.exe [488120 2012-08-08] (McAfee, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491632 2012-09-26] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [258576 2012-10-22] (CyberLink Corp.)
HKLM-x32\...\Run: [Ulead AutoDetector v2] => C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe [90112 2006-11-29] (Ulead Systems, Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2014-03-18] (shbox.de)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SHIWebOnDiskManager] => C:\Program Files (x86)\SHIWebOnDiskManager\SHIWebOnDiskManager.exe [245760 2013-09-03] (SHI Elektronische Medien GmbH)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [182352 2014-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2024800 2014-06-04] (Wondershare)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => "E:\KeePass Password Safe 2\KeePass.exe" --preload
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23308256 2015-01-15] (Google)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\...\Run: [GoogleChromeAutoLaunch_A8E54B6D2916471B1ADD0C74BB18AB2B] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [843592 2015-02-04] (Google Inc.)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\Run: [MyDriveConnect.exe] => C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe [1792376 2014-08-22] (TomTom)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\Run: [Avanquest message] => C:\Program Files (x86)\Avanquest\Avanquest message\AQNotif.exe [361272 2015-01-23] (Avanquest Software)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\Run: [PCSpeedUp] => C:\Program Files (x86)\PC Speed Up\PCSUNotifier.exe
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\RunOnce: [Adobe Speed Launcher] => 1423683804
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\RunOnce: [Report] => \AdwCleaner\AdwCleaner[S2].txt [1167 2015-02-11] ()
Startup: C:\Users\WoJa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\K L S K\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
Startup: C:\Users\WoJa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sidebar273.lnk
ShortcutTarget: Sidebar273.lnk -> C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
Startup: C:\Users\WoJa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
SearchScopes: HKU\S-1-5-21-3381209366-1052480604-4067403755-1005 -> {5A0DEF8F-41B3-443D-A2C0-BD3EF82F751D} URL = 
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF SearchEngineOrder.1: SuchMaschine
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\searchplugins\google-maps.xml
FF Extension: SparPilot - Gutscheine &amp; mehr... - C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\sparpilot@sparpilot.com [2015-02-12]
FF Extension: WEB.DE MailCheck - C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\toolbar@web.de [2015-02-12]
FF Extension: Download videos and MP3s from YouTube - C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-11-24]
FF Extension: {8fda392c-cadb-4cdd-85d1-9d45a3569966} - C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\{8fda392c-cadb-4cdd-85d1-9d45a3569966}.xpi [2015-02-12]
FF HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-24]

Chrome: 
=======
CHR Profile: C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-22]
CHR Extension: (Google Docs) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-22]
CHR Extension: (Google Drive) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-22]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-07]
CHR Extension: (YouTube) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-22]
CHR Extension: (Google-Suche) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-22]
CHR Extension: (Google Tabellen) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-22]
CHR Extension: (Google Wallet) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-22]
CHR Extension: (Google Mail) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-22]
CHR HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-18] ()
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [124496 2014-05-05] (Avira Operations GmbH & Co. KG)
R2 FreemakeVideoCapture; C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe [9216 2014-11-18] (Ellora Assets Corp.) [File not signed]
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [156672 2011-10-13] () [File not signed]
S2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2464400 2013-05-08] (Realsil Microelectronics Inc.)
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-09-18] (Intel Corporation)
R2 irstrtsv; C:\windows\SysWOW64\irstrtsv.exe [668984 2013-04-24] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-09-18] (Intel Corporation)
S2 lxebCATSCustConnectService; C:\windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe [45736 2010-04-14] (Lexmark International, Inc.)
S3 McAWFwk; C:\Program Files\McAfee\MSC\McAWFwk.exe [332080 2012-01-26] (McAfee, Inc.)
S2 McOobeSv2; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [219832 2012-06-17] (McAfee, Inc.)
R2 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-08-10] (Atheros) [File not signed]
S2 PCSUService; C:\Program Files (x86)\PC Speed Up\PCSUService.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
R3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [131584 2013-08-22] (Microsoft Corporation)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R3 irstrtdv; C:\Windows\System32\drivers\irstrtdv.sys [43800 2013-04-24] (Intel Corporation)
R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
S3 Pcan_usb; C:\Windows\System32\drivers\PCAN_USB.SYS [100864 2012-01-24] (PEAK-System Technik GmbH, Darmstadt, Germany)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-09-21] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44344 2012-09-21] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-15 20:07 - 2015-02-15 20:07 - 00024332 _____ () C:\Users\WoJa\Desktop\FRST.txt
2015-02-14 20:30 - 2015-02-15 19:34 - 02085888 _____ (Farbar) C:\Users\WoJa\Desktop\FRST64.exe
2015-02-14 20:30 - 2015-02-15 19:34 - 00000000 ____D () C:\Users\WoJa\Desktop\FRST-OlderVersion
2015-02-13 20:09 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-02-13 20:09 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-02-13 11:47 - 2015-02-13 11:47 - 02367488 _____ () C:\Users\WoJa\Downloads\tightvnc-2.7.10-setup-64bit (1).msi
2015-02-12 20:21 - 2015-02-12 20:21 - 00001182 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-12 20:21 - 2015-02-12 20:21 - 00001170 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-02-12 20:21 - 2015-02-12 20:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-12 20:20 - 2015-02-12 20:20 - 00243664 _____ () C:\Users\WoJa\Downloads\Firefox Setup Stub 35.0.1.exe
2015-02-12 20:17 - 2015-02-12 20:17 - 00001050 _____ () C:\Users\Public\Desktop\MozBackup.lnk
2015-02-12 20:17 - 2015-02-12 20:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
2015-02-12 20:16 - 2015-02-12 20:16 - 00000000 ____D () C:\Users\K L S K\AppData\Roaming\dlg
2015-02-12 20:14 - 2015-02-12 20:14 - 00001071 _____ () C:\Users\K L S K\Desktop\PC Speed Up.lnk
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\QuickScan
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\Users\K L S K\Documents\PCSpeedUp
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Speed Up
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\Program Files (x86)\WEB.DE MailCheck
2015-02-12 19:24 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-02-12 19:24 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-02-12 19:24 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-02-12 19:24 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-02-12 19:24 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-02-12 19:24 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-02-12 19:24 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2015-02-12 19:24 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2015-02-12 19:24 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2015-02-12 19:24 - 2014-12-09 00:12 - 00391526 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-02-12 19:22 - 2015-02-12 19:22 - 00165376 _____ () C:\Users\WoJa\Downloads\SystemLook_x64 (1).exe
2015-02-12 19:21 - 2015-02-12 19:21 - 00165376 _____ () C:\Users\WoJa\Desktop\SystemLook_x64.exe
2015-02-11 20:48 - 2015-02-11 20:48 - 02112512 _____ () C:\Users\WoJa\Desktop\AdwCleaner_4.110.exe
2015-02-11 20:48 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-02-11 20:48 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-02-11 20:48 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-02-11 20:48 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-02-11 20:48 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-02-11 20:47 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-02-11 20:47 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-02-11 20:47 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-02-11 20:47 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-02-11 20:47 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-02-11 20:47 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-02-11 20:47 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-02-11 20:47 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-02-11 20:47 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-02-11 20:47 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-02-11 20:47 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2015-02-11 20:47 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-02-11 20:47 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-02-11 20:47 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-02-11 20:47 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-02-11 20:47 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-02-11 20:47 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-02-11 20:47 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-02-11 20:47 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll
2015-02-11 20:47 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll
2015-02-11 20:47 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll
2015-02-11 20:47 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll
2015-02-11 20:47 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll
2015-02-11 20:47 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll
2015-02-11 20:46 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-02-11 20:46 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2015-02-11 20:46 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-02-11 20:46 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-02-11 20:46 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-02-11 20:46 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-02-11 20:46 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-02-11 20:46 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-02-11 20:46 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-02-11 20:46 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-02-11 20:46 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-02-11 20:46 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-02-11 20:46 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-02-11 20:46 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-02-11 20:46 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-02-11 20:46 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-02-11 20:46 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-02-11 20:46 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-02-11 20:45 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2015-02-11 20:45 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2015-02-11 20:45 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-02-11 20:45 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-02-11 20:45 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-02-11 20:45 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-02-11 20:45 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2015-02-11 20:45 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2015-02-11 20:45 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll
2015-02-11 20:45 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll
2015-02-11 20:45 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll
2015-02-11 20:45 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe
2015-02-11 20:45 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe
2015-02-11 20:45 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe
2015-02-10 10:51 - 2015-02-10 10:52 - 33703656 _____ (Any-Video-Converter.com ) C:\Users\WoJa\Downloads\avc-577free(1).exe
2015-02-10 07:23 - 2015-02-10 07:23 - 00040972 _____ () C:\Users\K L S K\Desktop\Addition.txt
2015-02-10 07:22 - 2015-02-10 07:23 - 00043294 _____ () C:\Users\K L S K\Desktop\FRST.txt
2015-02-10 07:21 - 2015-02-10 07:21 - 02132992 _____ (Farbar) C:\Users\K L S K\Desktop\FRST64.exe
2015-02-09 20:56 - 2015-02-09 23:28 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-02-09 20:56 - 2015-02-09 20:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-09 20:56 - 2015-02-09 20:56 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-09 20:56 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-02-09 20:56 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-02-09 20:56 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-02-09 19:50 - 2015-02-09 19:50 - 01388274 _____ (Thisisu) C:\Users\K L S K\Desktop\JRT.exe
2015-02-09 19:47 - 2015-02-09 19:47 - 00008673 _____ () C:\Users\K L S K\Desktop\AdwCleaner[S0].txt
2015-02-09 19:46 - 2015-02-09 23:46 - 00002236 _____ () C:\WINDOWS\PFRO.log
2015-02-09 19:44 - 2015-02-11 22:36 - 00000000 ____D () C:\AdwCleaner
2015-02-09 19:35 - 2015-02-09 19:35 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-09 18:38 - 2015-02-15 20:07 - 00000000 ____D () C:\FRST
2015-02-09 18:38 - 2015-02-09 18:39 - 00045314 _____ () C:\Users\WoJa\Downloads\FRST.txt
2015-02-09 18:38 - 2015-02-09 18:38 - 00024874 _____ () C:\Users\WoJa\Downloads\Addition.txt
2015-02-09 18:36 - 2015-02-09 18:37 - 02132992 _____ (Farbar) C:\Users\WoJa\Downloads\FRST64.exe
2015-02-08 12:12 - 2015-02-08 12:12 - 00055311 _____ () C:\Users\WoJa\Desktop\default.html
2015-02-08 08:48 - 2015-02-08 08:48 - 00000000 ____D () C:\Users\WoJa\AppData\Local\IsolatedStorage
2015-02-07 15:29 - 2015-02-15 20:06 - 00011584 _____ () C:\WINDOWS\setupact.log
2015-02-07 15:29 - 2015-02-07 15:29 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-02-07 13:09 - 2015-02-07 13:09 - 00001880 _____ () C:\Users\K L S K\Desktop\UseNeXT by Tangysoft.lnk
2015-02-07 13:09 - 2015-02-07 13:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UseNeXT
2015-02-07 13:09 - 2015-02-07 13:09 - 00000000 ____D () C:\Program Files (x86)\UseNeXT
2015-02-07 13:04 - 2015-02-07 13:04 - 00002776 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2015-02-07 13:04 - 2015-02-07 13:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-02-07 13:04 - 2015-02-07 13:04 - 00000000 ____D () C:\Program Files\CCleaner
2015-02-07 12:55 - 2015-02-07 12:55 - 05270008 _____ (Tangysoft Ltd. ) C:\Users\WoJa\Downloads\UseNeXTSetup_5.64(1).exe
2015-02-07 12:35 - 2015-02-07 12:35 - 00000000 __SHD () C:\Users\WoJa\AppData\Local\EmieBrowserModeList
2015-02-06 19:52 - 2015-02-06 19:52 - 00000000 ____D () C:\Program Files (x86)\Avanquest update
2015-02-03 17:48 - 2015-02-04 12:09 - 00000581 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass 2.lnk
2015-02-03 17:44 - 2015-02-03 17:44 - 02536151 _____ (Dominik Reichl ) C:\Users\WoJa\Downloads\KeePass-2.28-Setup.exe
2015-01-28 16:37 - 2015-01-28 16:37 - 05270008 _____ (Tangysoft Ltd. ) C:\Users\WoJa\Downloads\UseNeXTSetup_5.64.exe
2015-01-28 08:51 - 2015-01-28 08:51 - 03980064 _____ (TeamViewer) C:\Users\WoJa\Downloads\teamviewer.exe
2015-01-26 20:49 - 2015-01-26 20:49 - 00000000 ___SD () C:\Users\WoJa\Documents\Meine Datenquellen
2015-01-25 17:38 - 2015-02-08 08:48 - 00000000 ____D () C:\Users\WoJa\AppData\Local\Photo Explosion
2015-01-25 17:38 - 2015-01-25 17:38 - 00000125 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2015-01-25 16:56 - 2015-01-25 16:56 - 01525048 _____ (Avanquest Software) C:\Users\WoJa\Downloads\InPixioPhotoFocus3.0_DM.exe
2015-01-25 16:36 - 2015-01-25 16:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avanquest
2015-01-25 16:32 - 2015-01-25 16:35 - 86216328 _____ (Avanquest Software) C:\Users\WoJa\Downloads\Ausschneiden_2.0.3.exe
2015-01-25 16:28 - 2015-02-06 19:54 - 00000000 ____D () C:\Users\K L S K\AppData\Local\Avanquest
2015-01-25 16:26 - 2015-01-25 16:28 - 00000000 ____D () C:\Users\K L S K\AppData\Local\NGPR
2015-01-25 16:26 - 2015-01-25 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InPixio Photo Maximizer
2015-01-25 16:26 - 2015-01-25 16:26 - 00000000 ____D () C:\Program Files (x86)\InPixio Photo Maximizer
2015-01-25 16:15 - 2015-02-07 11:56 - 00000000 ____D () C:\Users\WoJa\AppData\Local\NGPR
2015-01-25 16:15 - 2015-01-25 17:39 - 00000000 ____D () C:\Users\WoJa\AppData\Local\Avanquest
2015-01-25 16:14 - 2015-02-06 19:52 - 00000000 ____D () C:\ProgramData\Avanquest
2015-01-25 16:14 - 2015-01-25 16:58 - 00000000 ____D () C:\Users\Public\Documents\Avanquest Software
2015-01-25 16:14 - 2015-01-25 16:58 - 00000000 ____D () C:\ProgramData\Configuration
2015-01-25 16:14 - 2015-01-25 16:14 - 00000000 ____D () C:\ProgramData\Avanquest Software
2015-01-25 16:10 - 2015-01-25 17:12 - 00000000 ___RD () C:\Users\WoJa\Desktop\Fotobearbeitung
2015-01-25 16:08 - 2015-01-25 16:10 - 42955192 _____ (Avanquest Software) C:\Users\WoJa\Downloads\InPixio_Photo_Maximizer_MLT.exe
2015-01-25 15:35 - 2015-01-25 16:58 - 00000000 ____D () C:\Program Files (x86)\Avanquest
2015-01-25 15:35 - 2015-01-25 15:35 - 01841528 _____ (Avanquest Software) C:\Users\WoJa\Downloads\Foto-Software_Ausschneiden_DE_FT.exe
2015-01-25 14:54 - 2015-01-25 14:54 - 00000000 ____D () C:\ProgramData\PDFEditor
2015-01-25 14:54 - 2015-01-25 14:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2015-01-25 14:54 - 2014-12-16 21:10 - 00096328 _____ (Wondershare Software) C:\WINDOWS\system32\WSMonEditor.dll
2015-01-23 14:34 - 2015-01-23 14:34 - 00020992 _____ () C:\Users\WoJa\Desktop\7,49.ufo
2015-01-16 08:25 - 2015-01-16 10:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-01-16 06:45 - 2015-02-15 20:07 - 00000000 ___RD () C:\Users\WoJa\Dropbox
2015-01-16 06:45 - 2015-02-13 10:39 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-01-16 06:44 - 2015-02-15 20:07 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\Dropbox
2015-01-16 06:44 - 2015-01-16 06:45 - 00000000 ____D () C:\Users\K L S K\AppData\Roaming\Dropbox
2015-01-16 06:43 - 2015-01-16 06:43 - 00324136 _____ (Dropbox, Inc.) C:\Users\WoJa\Downloads\DropboxInstaller.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-15 20:08 - 2014-03-21 14:23 - 00000000 ____D () C:\Users\WoJa\Documents\Youcam
2015-02-15 20:07 - 2014-03-31 16:06 - 00000000 ____D () C:\Users\WoJa\AppData\Local\FreePDF_XP
2015-02-15 20:07 - 2014-03-24 06:46 - 00000000 ___RD () C:\Users\WoJa\Google Drive
2015-02-15 20:07 - 2014-03-24 06:44 - 00001142 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-15 20:07 - 2014-03-21 14:22 - 00000000 __RDO () C:\Users\WoJa\SkyDrive
2015-02-15 20:07 - 2014-03-21 14:19 - 00701401 _____ () C:\ProgramData\lxeb.log
2015-02-15 20:07 - 2014-03-21 11:05 - 00101382 _____ () C:\ProgramData\lxebscan.log
2015-02-15 20:07 - 2013-05-13 13:44 - 00000868 _____ () C:\WINDOWS\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2015-02-15 20:06 - 2014-03-21 13:39 - 01108549 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-15 20:06 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-15 20:06 - 2013-08-22 14:25 - 02097152 ___SH () C:\WINDOWS\system32\config\BBI
2015-02-15 20:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-02-15 19:53 - 2014-03-21 15:06 - 00003946 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{132EB2ED-B4C8-4356-953F-243BB0BA9D63}
2015-02-15 19:51 - 2014-03-21 14:27 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3381209366-1052480604-4067403755-1005
2015-02-15 19:46 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-02-15 19:39 - 2013-11-14 08:26 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-02-15 19:39 - 2013-11-14 08:11 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2015-02-15 19:39 - 2013-11-14 08:11 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2015-02-15 14:21 - 2014-07-17 13:57 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-02-15 14:21 - 2014-03-24 06:44 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-14 20:47 - 2014-03-22 16:21 - 02145280 ___SH () C:\Users\WoJa\Desktop\Thumbs.db
2015-02-14 12:32 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-02-14 12:22 - 2013-05-13 13:44 - 00000870 _____ () C:\WINDOWS\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2015-02-14 10:51 - 2014-05-16 20:33 - 00000000 ___RD () C:\Users\WoJa\Desktop\Schulungen
2015-02-14 10:14 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-02-13 21:02 - 2014-11-15 20:10 - 00000000 ____D () C:\Users\WoJa\Desktop\Pressemeldungen_LaSi
2015-02-13 20:47 - 2014-07-09 21:22 - 00002338 _____ () C:\Users\K L S K\Desktop\Google Chrome.lnk
2015-02-13 13:06 - 2014-04-29 12:40 - 00000000 ____D () C:\Users\WoJa\Documents\Outlook-Dateien
2015-02-13 12:55 - 2014-11-06 20:27 - 00000000 ____D () C:\Users\WoJa\Desktop\Spenner
2015-02-13 11:55 - 2014-07-08 16:20 - 00000519 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.ics
2015-02-13 11:47 - 2014-07-08 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TightVNC
2015-02-13 11:47 - 2014-07-08 16:46 - 00000000 ____D () C:\Program Files\TightVNC
2015-02-13 10:37 - 2013-08-22 15:44 - 00511368 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-13 10:36 - 2014-03-21 11:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-12 22:55 - 2013-12-13 10:38 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-02-12 22:52 - 2014-12-12 15:45 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2015-02-12 22:52 - 2014-07-11 21:28 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2015-02-12 22:52 - 2013-04-11 08:30 - 116773704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-02-12 22:10 - 2014-04-20 16:56 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\UseNeXT
2015-02-11 23:20 - 2014-03-27 20:28 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-11 23:20 - 2014-03-21 18:00 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-11 23:20 - 2012-07-26 06:26 - 00000482 _____ () C:\WINDOWS\win.ini
2015-02-11 20:44 - 2014-05-08 15:59 - 00000000 ____D () C:\Users\K L S K\Documents\Youcam
2015-02-11 20:43 - 2013-05-13 14:49 - 00003306 _____ () C:\WINDOWS\System32\Tasks\Intel® Rapid Start Technology Manager
2015-02-10 08:37 - 2014-05-08 16:04 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3381209366-1052480604-4067403755-1008
2015-02-09 19:46 - 2014-06-15 09:24 - 00001102 _____ () C:\Users\K L S K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2015-02-09 19:46 - 2014-06-15 09:24 - 00001072 _____ () C:\Users\K L S K\Desktop\Search.lnk
2015-02-09 12:21 - 2014-06-15 20:07 - 00001226 _____ () C:\Users\K L S K\Desktop\Any Video Converter.lnk
2015-02-09 12:21 - 2014-06-15 20:07 - 00000000 ____D () C:\Users\K L S K\AppData\Roaming\AnvSoft
2015-02-09 10:45 - 2014-05-15 15:47 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\vlc
2015-02-07 13:50 - 2014-03-29 13:47 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\AIMP3
2015-02-07 13:04 - 2014-03-21 20:46 - 00000000 ____D () C:\WINDOWS\Minidump
2015-02-07 13:04 - 2014-03-21 13:33 - 00000000 ___DC () C:\WINDOWS\Panther
2015-02-07 11:52 - 2014-03-21 14:22 - 00000000 ____D () C:\Users\WoJa\AppData\Local\VirtualStore
2015-02-07 11:16 - 2014-03-24 06:44 - 00004118 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 11:16 - 2014-03-24 06:44 - 00003882 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-07 10:56 - 2014-11-27 06:16 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2015-02-07 10:56 - 2014-11-27 06:15 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2015-02-07 10:56 - 2014-11-27 06:15 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2015-02-07 10:56 - 2014-11-27 06:15 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-02-07 10:56 - 2014-11-27 06:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-07 10:56 - 2014-11-27 06:15 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-07 10:56 - 2014-09-27 07:20 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-07 10:55 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\LiveKernelReports
2015-02-06 19:52 - 2013-05-13 13:56 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-05 14:21 - 2014-07-17 13:57 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-02-04 12:11 - 2014-03-27 21:50 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\KeePass
2015-02-03 20:31 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-30 19:47 - 2015-01-13 17:15 - 00000000 ____D () C:\Users\WoJa\Desktop\Schulter-OP
2015-01-30 18:32 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-01-28 14:17 - 2014-03-24 06:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-01-28 08:51 - 2014-09-22 19:10 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\TeamViewer
2015-01-23 11:24 - 2014-12-16 19:44 - 00000000 ____D () C:\Users\WoJa\Desktop\Steuern
2015-01-16 11:38 - 2014-03-21 11:06 - 00000000 ____D () C:\ProgramData\Lx_cats
2015-01-16 06:45 - 2015-01-15 19:31 - 00000000 ____D () C:\Users\WoJa\Desktop\Gollmer
2015-01-16 06:45 - 2014-03-21 13:37 - 00000000 ____D () C:\Users\WoJa

==================== Files in the root of some directories =======

2014-06-13 19:51 - 2014-06-13 19:51 - 0000057 _____ () C:\ProgramData\Ament.ini
2014-03-21 11:09 - 2014-03-21 11:09 - 0000252 _____ () C:\ProgramData\FastPics.log
2014-03-21 14:19 - 2015-02-15 20:07 - 0701401 _____ () C:\ProgramData\lxeb.log
2014-04-19 19:01 - 2014-07-02 10:19 - 0000309 _____ () C:\ProgramData\lxebDiagnostics.log
2014-03-21 11:08 - 2014-06-12 11:20 - 0097172 _____ () C:\ProgramData\lxebJSW.log
2014-03-21 11:05 - 2015-02-15 20:07 - 0101382 _____ () C:\ProgramData\lxebscan.log
2015-01-25 17:38 - 2015-01-25 17:38 - 0000125 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2014-03-21 11:04 - 2014-03-21 11:04 - 0000000 _____ () C:\ProgramData\UpdaterLog.txt
2013-12-13 09:24 - 2013-12-13 09:25 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-12-13 09:22 - 2013-12-13 09:23 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-12-13 09:23 - 2013-12-13 09:24 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log

Some content of TEMP:
====================
C:\Users\WoJa\AppData\Local\Temp\avgnt.exe
C:\Users\WoJa\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpnnfaih.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-12 11:53

==================== End Of Log ============================

--- --- ---

sunjojo · 16.02.2015, 17:12

So, wir habens geschafft. Der Proxy ist weg

. Wenn du keine Probleme mehr hast (nach Schritt 1, du musst mir das Logfile auch nicht posten), sind wir hiermit auch fertig.

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\Run: [PCSpeedUp] => C:\Program Files (x86)\PC Speed Up\PCSUNotifier.exe
SearchScopes: HKU\S-1-5-21-3381209366-1052480604-4067403755-1005 -> {5A0DEF8F-41B3-443D-A2C0-BD3EF82F751D} URL = 
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF SearchEngineOrder.1: SuchMaschine
FF Extension: SparPilot - Gutscheine &amp; mehr... - C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\sparpilot@sparpilot.com [2015-02-12]
FF Extension: {8fda392c-cadb-4cdd-85d1-9d45a3569966} - C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\{8fda392c-cadb-4cdd-85d1-9d45a3569966}.xpi [2015-02-12]
CHR HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - No Path
S2 PCSUService; C:\Program Files (x86)\PC Speed Up\PCSUService.exe [X]
2015-02-12 20:14 - 2015-02-12 20:14 - 00001071 _____ () C:\Users\K L S K\Desktop\PC Speed Up.lnk
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\QuickScan
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\Users\K L S K\Documents\PCSpeedUp
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Speed Up
2015-02-10 10:51 - 2015-02-10 10:52 - 33703656 _____ (Any-Video-Converter.com ) C:\Users\WoJa\Downloads\avc-577free(1).exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Cleanup
Falls du Malwarebytes Anti-Malware und den ESET Online Scanner nicht mehr behalten möchtest, kannst du diese über die Systemsteuerung deinstallieren. Ich empfehle dir, mindestens ein Programm zu behalten (näheres in den Tipps).

Windows XP: Start --> Systemsteuerung --> Kategorieansicht auswählen (falls nicht voreingestellt) --> Software
Windows Vista/7: Start --> Systemsteuerung --> Anzeige (oben-rechts) auf Kategorie stellen (falls nicht voreingestellt) --> Programme deinstallieren (Unterpunkt von Programme)
Windows 8: Suchen --> "Systemsteuerung" in das Suchfeld eingeben --> Systemsteuerung auswählen --> Programme deinstallieren (Unterpunkt von Programme)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

In deinen Logfiles sehe ich im Moment keine schädlichen Einträge mehr, du bist in meinen Augen Clean. Für die Zukunft habe ich dir Tipps aufgeschrieben, damit du uns in nächster Zeit nicht mehr brauchst

.

Tipps - Frequently Asked Questions (FAQ)/Häufig gestellte Fragen

Welcher Antivirenscanner ist der beste?

Die Antwort auf die Frage ist im Grunde einfach: keiner. Es gibt keinen Antivirenscanner, der immer alle Schädlinge sofort erkennt und dich 100%ig schützt. Alles vom Menschen geschaffene ist fehlerhaft und es ist ratsam, sich nur begrenzt darauf zu verlassen. Das heißt nicht, dass die Verwendung eines Antivirenprogramms keinen Sinn macht, aber es sollte als zusätzliche Hilfe angesehen werden. Die Hauptverantwortung liegt bei dir und deinem Verhalten im Internet selbst.

Benutze nur einen Antivirenscanner/Hintergrundwächter, niemals zwei oder mehrere. Diese könnten sich gegenseitig blockieren und dir mehr schaden, als helfen. Achte darauf, dass immer die neuesten Updates heruntergeladen werden. Ein veralteter Antivirenscanner ist nutzlos!
- Ein gutes Antivirenprogramm ist Emsisoft Anti-Malware.

Außerdem kannst du dein Betriebssystem mit On-Demand Sannern überprüfen. Solche Scanner laufen nicht permanent im Hintergrund, sondern scannen nur "auf Knopfdruck" dein System. Damit holst du dir eine zweite Meinung ein. Gute On-Demand Scanner, die auch wir zur Kontrolle benutzen, sind Malwarebytes Anti Malware und der ESET Online Scanner.
- Malwarebytes Anti-Malware (Anleitung zur Verwendung) ist eines der besten und zuverlässigsten Programme in der Malwareentfernung. Scanne dein System einmal pro Woche oder einmal in zwei Wochen.
- Der ESET Online Scanner (Anleitung zur Verwendung) ist kostenlos und scannt dein System und deine Dateien sehr gründlich. Deswegen kann der Scan bei vielen Dateien mehrere Stunden dauern. Scanne dein System nach deinem eigenem Ermessen. Falls schädliche Dateien gefunden werden, handle nicht eigenmächtig!

Aber Updates muss ich immer installieren, oder?

Die Aktualität von Software ist sehr wichtig und unbedingt notwendig. Veraltete Programme stellen Schwachstellen dar, die sich Angreifer gerne zur Nutze machen. Daher ist es wichtig, immer die neueste Version der jeweiligen Software installiert zu haben. Dies fängt beim Betriebssystem an. Du solltest das neueste Service Pack installiert und automatische Updates eingeschaltet haben.
Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Windows 8: Suchen --> "Systemsteuerung" in das Suchfeld eingeben --> Systemsteuerung auswählen --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren

Häufig werden Sicherheitslücken von älteren Java Versionen, dem Flash-Player und PDF-Reader ausgenutzt. Du kannst hier überprüfen, ob diese häufig missbrauchte Software aktuell ist: PluginCheck

Außerdem empfehle ich dir den http://www.trojaner-board.de/83959-s...tml#post510373. Dieser überprüft, ob du veraltete Software auf deinem Rechner verwendest und kann sie in manchen Fällen automatisch updaten.

Ok, muss ich auf etwas achten, wenn ich im Internet surfe?

Mit dem richtigen Verhalten im Internet fängt der Schutz vor Infektionen an. Es gibt inzwischen viele virtuelle Betrugsversuche oder Tricks zum Täuschen, sowie im echten Leben. Um sich dort zu schützen, hast du bestimmte Angewohnheiten. Diese können auf das Surfverhalten übertragen werden. Zur Verdeutlichung stelle ich dir einen kleinen Vergleich zum Leben her:

Verhalten im Leben	Verhalten im Internet
Du überprüfst vorher die Läden, in denen du einkaufst.	Klicke nicht auf alle Seiten/Werbungen/PopUps, weil diese bunt sind oder tolle Preise versprechen.
Du achtest auf die Qualität, wenn du Produkte kaufst.	Lade dir Programme nur von original Herstellerseiten herunter und nicht von Softonic oder ähnlichem. Diese birgen häufig die Gefahr, sich zusätzlich Adware herunterzuladen.
Du öffnest keine Briefe oder Pakete ohne zu gucken, von wem diese sind.	Öffne nur Anhänge von Emails, wenn der Absender bekannt ist. Überprüfe, ob zum Beispiel eine Rechnung im Anhang wirklich von der Firma versendet wurde. Häufig werden gefälschte Emails mit schädlichem Anhang verschickt!

Handle mit Bedacht und überlege zuerst, bevor du etwas anklickst, herunterlädst oder öffnest!

Vermeide das Besuchen von pornographischen, Pokerspiel oder weiteren dubiosen Webseiten. Diese birgen ein besonders großes Infektionsrisiko.

Welche Programme sollte ich nicht verwenden?

Wenn du neue Software installierst, besteht häufig die Auswahl, eine weitere Toolbar (oder ähnliches) zu installieren. Entferne generell den Haken bei optionalen Zusatzprogrammen. Diese verlangsamen in der Regel deinen Browser und können ein erhöhtes Infektionsrisiko bedeuten.

Registry Cleaner versprechen meist einen großen Performancegewinn, wenn verwaiste Einträge in der Regsitry entfernt werden. Dieser angebliche Gewinn ist kaum bis gar nicht bemerkbar. Außerdem wird häufig verschwiegen, dass falsche Änderungen der Registry zu schwerwiegenden Folgen führen können. Deswegen sollte so wenig wie möglich an der Registry verändert werden. Zerstörst du die Registry, zerstörst du Windows!

Filesharing oder Peer-to-Peer Programme ermöglichen es, Dateien mit anderen Nutzern auszutauschen. Es ist möglich, dass du dir eine infizierte Datei herunterlädst (auch versteckt in angeblich legalen Versionen von bekannten Programmen). Du kannst niemals wissen, woher diese stammen. Daher sollte diese Art von Software mit äußerster Vorsicht oder gar nicht benutzt werden.
- Lade dir vor allem keine Cracks (illegale Version einer Software) herunter. Das ist rechtlich nicht erlaubt und du kannst dafür bestraft werden. Außerdem ist bei solcher Software das Infektionsrisiko am höchsten, da Cracks sehr häufig versteckte Malware enthalten.

Gibt es noch weitere Tipps, um mich zu schützen?

Achte auf die Endung von Dateien, die dir zugesendet wurden. Häufig versuchen Malwareschreiber mit Tricks wie Rechnung.pdf.exe dich zu täuschen. Wenn die Dateiendung ausgeblendet wird, bleibt Rechnung.pdf übrig, was den Anschein einer normalen PDF-Datei macht. Lass dir daher bekannte Dateiendung anzeigen (Anleitung: http://www.trojaner-board.de/59624-a...-sichtbar.html)

Surfe mit einem Konto mit eingeschränkten Rechten. Durch Administratorrechte kann Malware ohne Probleme zahlreiche Änderungen am System vornehmen, zum Beispiel Sicherheitseinstellungen verändern oder auf Systemdateien zugreifen.
Verwende nicht immer das gleiche Passwort. Falls dein Passwort durch entsprechende Malware herausgefunden wird, könnte auf alle Konten von dir zugegriffen werden.

Lege in regelmäßigen Abständen Backups (Was sind Backups?) von deinem System an. Dadurch ist ein Datenverlust durch Malware oder Hardwareschäden verkraftbar und es ist vergleichsweise einfach, den Rechner auf den Stand des letzten Backups zu bringen. Damit du deine Daten nicht manuell sichern musst, gibt es Backup-Programme wie Paragon Backup & Recovery.

Deaktiviere das Autorun-Feature von Windows. Dies ermöglicht, dass zum Beispiel CDs, DVDs oder Programme auf USB-Sticks alleine starten. Häufig nutzen Malwareschreiber genau diese Funktion aus. In solchen Fällen befindet sich Malware auf dem USB-Stick und wird automatisch beim Anschließen an den Computer ausgeführt. Um das zu verhinden, deaktiviere die Autorun-Funktion: http://www.trojaner-board.de/83238-a...sschalten.html.

Wenn dich das Thema Computersicherheit interessiert und du noch mehr Tipps und Tricks zum Schutz deines Rechners haben willst, ist der Emsisoft Blog genau richtig für dich

.

Wenn du die Arbeit des Trojaner-Boards unterstützen möchtest, kannst du gerne spenden

.

Ich wünsche dir eine schöne und malwarefreie Zeit

.

Corsipo · 16.02.2015, 20:01

Leider werden mir in Firefox weiterhin die vielen Popups angezeigt.

Hier der Log:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-02-2015
Ran by K L S K at 2015-02-16 19:53:20 Run:10
Running from C:\Users\WoJa\Desktop
Loaded Profiles: WoJa & K L S K (Available profiles: Wolfgang & WoJa & K L S K)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\Run: [PCSpeedUp] => C:\Program Files (x86)\PC Speed Up\PCSUNotifier.exe
SearchScopes: HKU\S-1-5-21-3381209366-1052480604-4067403755-1005 -> {5A0DEF8F-41B3-443D-A2C0-BD3EF82F751D} URL = 
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF SearchEngineOrder.1: SuchMaschine
FF Extension: SparPilot - Gutscheine &amp; mehr... - C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\sparpilot@sparpilot.com [2015-02-12]
FF Extension: {8fda392c-cadb-4cdd-85d1-9d45a3569966} - C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\{8fda392c-cadb-4cdd-85d1-9d45a3569966}.xpi [2015-02-12]
CHR HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - No Path
S2 PCSUService; C:\Program Files (x86)\PC Speed Up\PCSUService.exe [X]
2015-02-12 20:14 - 2015-02-12 20:14 - 00001071 _____ () C:\Users\K L S K\Desktop\PC Speed Up.lnk
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\QuickScan
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\Users\K L S K\Documents\PCSpeedUp
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Speed Up
2015-02-10 10:51 - 2015-02-10 10:52 - 33703656 _____ (Any-Video-Converter.com ) C:\Users\WoJa\Downloads\avc-577free(1).exe
         
*****************

HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\Software\Microsoft\Windows\CurrentVersion\Run\\PCSpeedUp => value deleted successfully.
"HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5A0DEF8F-41B3-443D-A2C0-BD3EF82F751D}" => Key deleted successfully.
HKCR\CLSID\{5A0DEF8F-41B3-443D-A2C0-BD3EF82F751D} => Key not found. 
Firefox newtab deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\sparpilot@sparpilot.com => Moved successfully.
C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\{8fda392c-cadb-4cdd-85d1-9d45a3569966}.xpi => Moved successfully.
"HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\SOFTWARE\Google\Chrome\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh" => Key deleted successfully.
PCSUService => Service deleted successfully.
C:\Users\K L S K\Desktop\PC Speed Up.lnk => Moved successfully.
C:\Users\WoJa\AppData\Roaming\QuickScan => Moved successfully.
C:\Users\K L S K\Documents\PCSpeedUp => Moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Speed Up => Moved successfully.
C:\Users\WoJa\Downloads\avc-577free(1).exe => Moved successfully.

==== End of Fixlog 19:53:20 ====

sunjojo · 16.02.2015, 20:11

Hmm, ok.

Wird die Werbung nur im Firefox angezeigt, oder auch in anderen Browsern?

Mach nochmal ein neues FRST Logfile.

Corsipo · 16.02.2015, 20:24

Die Werbung wird nur im Firefox angezeigt.
Ca. vier bis fünf popups...
Wenn ich dann auf der Seite einen Link anklicke (nicht von den popups) dann öffnet sich erstmal eine fremder Tab. Dann wird ersucht, irgendwelche Dateien zu installieren, was ich natürlich immer wegklicke.

Hier der FRST-Log:

[CODE][/CO
FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-02-2015
Ran by K L S K (administrator) on WOJA-WIN-8_PC on 16-02-2015 20:21:43
Running from C:\Users\WoJa\Desktop
Loaded Profiles: WoJa & K L S K (Available profiles: Wolfgang & WoJa & K L S K)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files (x86)\PHotkey\AsLdrSrv.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Ellora Assets Corp.) C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
() C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
() C:\Program Files (x86)\PHotkey\PVDesktop.exe
() C:\Program Files (x86)\PHotkey\PVDAgent.exe
(Pegatron Corporation) C:\Program Files (x86)\PHotkey\MyWiMax.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe
() C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
( ) C:\Windows\SysWOW64\lxebcoms.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Dropbox, Inc.) C:\Users\WoJa\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Windows\Temp\irstrtsv\scrncap.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] => C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [764032 2012-08-10] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [127616 2012-08-10] (Atheros Communications)
HKLM\...\Run: [lxebmon.exe] => C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe [772712 2013-01-23] ()
HKLM\...\Run: [EzPrint] => C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe [150264 2013-01-23] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2930488 2012-09-21] (Synaptics Incorporated)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [tvncontrol] => C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-11-19] (Intel Corporation)
HKLM-x32\...\Run: [ATLauncher] => C:\Program Files\McAfee\MSC\OOBE\ATLauncher.exe [488120 2012-08-08] (McAfee, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491632 2012-09-26] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [258576 2012-10-22] (CyberLink Corp.)
HKLM-x32\...\Run: [Ulead AutoDetector v2] => C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe [90112 2006-11-29] (Ulead Systems, Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2014-03-18] (shbox.de)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SHIWebOnDiskManager] => C:\Program Files (x86)\SHIWebOnDiskManager\SHIWebOnDiskManager.exe [245760 2013-09-03] (SHI Elektronische Medien GmbH)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [182352 2014-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2024800 2014-06-04] (Wondershare)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => "E:\KeePass Password Safe 2\KeePass.exe" --preload
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23308256 2015-01-15] (Google)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\...\Run: [GoogleChromeAutoLaunch_A8E54B6D2916471B1ADD0C74BB18AB2B] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [843592 2015-02-04] (Google Inc.)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\Run: [MyDriveConnect.exe] => C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe [1792376 2014-08-22] (TomTom)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\Run: [Avanquest message] => C:\Program Files (x86)\Avanquest\Avanquest message\AQNotif.exe [361272 2015-01-23] (Avanquest Software)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\RunOnce: [Adobe Speed Launcher] => 1423683804
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\RunOnce: [Report] => \AdwCleaner\AdwCleaner[S2].txt [1167 2015-02-11] ()
Startup: C:\Users\WoJa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\K L S K\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
Startup: C:\Users\WoJa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sidebar273.lnk
ShortcutTarget: Sidebar273.lnk -> C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
Startup: C:\Users\WoJa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3381209366-1052480604-4067403755-1005\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\searchplugins\google-maps.xml
FF Extension: WEB.DE MailCheck - C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\toolbar@web.de [2015-02-12]
FF Extension: Download videos and MP3s from YouTube - C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-11-24]
FF HKU\S-1-5-21-3381209366-1052480604-4067403755-1008\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-24]

Chrome: 
=======
CHR Profile: C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-22]
CHR Extension: (Google Docs) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-22]
CHR Extension: (Google Drive) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-22]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-07]
CHR Extension: (YouTube) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-22]
CHR Extension: (Google-Suche) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-22]
CHR Extension: (Google Tabellen) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-22]
CHR Extension: (Google Wallet) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-22]
CHR Extension: (Google Mail) - C:\Users\K L S K\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-18] ()
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [124496 2014-05-05] (Avira Operations GmbH & Co. KG)
R2 FreemakeVideoCapture; C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe [9216 2014-11-18] (Ellora Assets Corp.) [File not signed]
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [156672 2011-10-13] () [File not signed]
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2464400 2013-05-08] (Realsil Microelectronics Inc.)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-09-18] (Intel Corporation)
R2 irstrtsv; C:\windows\SysWOW64\irstrtsv.exe [668984 2013-04-24] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-09-18] (Intel Corporation)
S2 lxebCATSCustConnectService; C:\windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe [45736 2010-04-14] (Lexmark International, Inc.)
S3 McAWFwk; C:\Program Files\McAfee\MSC\McAWFwk.exe [332080 2012-01-26] (McAfee, Inc.)
S2 McOobeSv2; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [219832 2012-06-17] (McAfee, Inc.)
R2 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-08-10] (Atheros) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
R3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [131584 2013-08-22] (Microsoft Corporation)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R3 irstrtdv; C:\Windows\System32\drivers\irstrtdv.sys [43800 2013-04-24] (Intel Corporation)
R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
S3 Pcan_usb; C:\Windows\System32\drivers\PCAN_USB.SYS [100864 2012-01-24] (PEAK-System Technik GmbH, Darmstadt, Germany)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-09-21] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44344 2012-09-21] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-16 20:21 - 2015-02-16 20:21 - 00023673 _____ () C:\Users\WoJa\Desktop\FRST.txt
2015-02-14 20:30 - 2015-02-15 19:34 - 02085888 _____ (Farbar) C:\Users\WoJa\Desktop\FRST64.exe
2015-02-14 20:30 - 2015-02-15 19:34 - 00000000 ____D () C:\Users\WoJa\Desktop\FRST-OlderVersion
2015-02-13 20:09 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-02-13 20:09 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-02-13 11:47 - 2015-02-13 11:47 - 02367488 _____ () C:\Users\WoJa\Downloads\tightvnc-2.7.10-setup-64bit (1).msi
2015-02-12 20:21 - 2015-02-12 20:21 - 00001182 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-12 20:21 - 2015-02-12 20:21 - 00001170 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-02-12 20:21 - 2015-02-12 20:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-12 20:20 - 2015-02-12 20:20 - 00243664 _____ () C:\Users\WoJa\Downloads\Firefox Setup Stub 35.0.1.exe
2015-02-12 20:17 - 2015-02-12 20:17 - 00001050 _____ () C:\Users\Public\Desktop\MozBackup.lnk
2015-02-12 20:17 - 2015-02-12 20:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
2015-02-12 20:16 - 2015-02-12 20:16 - 00000000 ____D () C:\Users\K L S K\AppData\Roaming\dlg
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\Program Files (x86)\WEB.DE MailCheck
2015-02-12 19:24 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-02-12 19:24 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-02-12 19:24 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-02-12 19:24 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-02-12 19:24 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-02-12 19:24 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-02-12 19:24 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2015-02-12 19:24 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2015-02-12 19:24 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2015-02-12 19:24 - 2014-12-09 00:12 - 00391526 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-02-12 19:22 - 2015-02-12 19:22 - 00165376 _____ () C:\Users\WoJa\Downloads\SystemLook_x64 (1).exe
2015-02-12 19:21 - 2015-02-12 19:21 - 00165376 _____ () C:\Users\WoJa\Desktop\SystemLook_x64.exe
2015-02-11 20:48 - 2015-02-11 20:48 - 02112512 _____ () C:\Users\WoJa\Desktop\AdwCleaner_4.110.exe
2015-02-11 20:48 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-02-11 20:48 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-02-11 20:48 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-02-11 20:48 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-02-11 20:48 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-02-11 20:47 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-02-11 20:47 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-02-11 20:47 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-02-11 20:47 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-02-11 20:47 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-02-11 20:47 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-02-11 20:47 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-02-11 20:47 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-02-11 20:47 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-02-11 20:47 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-02-11 20:47 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2015-02-11 20:47 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-02-11 20:47 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-02-11 20:47 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-02-11 20:47 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-02-11 20:47 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-02-11 20:47 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-02-11 20:47 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-02-11 20:47 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll
2015-02-11 20:47 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll
2015-02-11 20:47 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll
2015-02-11 20:47 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll
2015-02-11 20:47 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll
2015-02-11 20:47 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll
2015-02-11 20:46 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-02-11 20:46 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2015-02-11 20:46 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-02-11 20:46 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-02-11 20:46 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-02-11 20:46 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-02-11 20:46 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-02-11 20:46 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-02-11 20:46 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-02-11 20:46 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-02-11 20:46 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-02-11 20:46 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-02-11 20:46 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-02-11 20:46 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-02-11 20:46 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-02-11 20:46 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-02-11 20:46 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-02-11 20:46 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-02-11 20:45 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2015-02-11 20:45 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2015-02-11 20:45 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-02-11 20:45 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-02-11 20:45 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-02-11 20:45 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-02-11 20:45 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2015-02-11 20:45 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2015-02-11 20:45 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll
2015-02-11 20:45 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll
2015-02-11 20:45 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll
2015-02-11 20:45 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe
2015-02-11 20:45 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe
2015-02-11 20:45 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe
2015-02-10 07:23 - 2015-02-10 07:23 - 00040972 _____ () C:\Users\K L S K\Desktop\Addition.txt
2015-02-10 07:22 - 2015-02-10 07:23 - 00043294 _____ () C:\Users\K L S K\Desktop\FRST.txt
2015-02-10 07:21 - 2015-02-10 07:21 - 02132992 _____ (Farbar) C:\Users\K L S K\Desktop\FRST64.exe
2015-02-09 20:56 - 2015-02-09 23:28 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-02-09 20:56 - 2015-02-09 20:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-09 20:56 - 2015-02-09 20:56 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-09 20:56 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-02-09 20:56 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-02-09 20:56 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-02-09 19:50 - 2015-02-09 19:50 - 01388274 _____ (Thisisu) C:\Users\K L S K\Desktop\JRT.exe
2015-02-09 19:47 - 2015-02-09 19:47 - 00008673 _____ () C:\Users\K L S K\Desktop\AdwCleaner[S0].txt
2015-02-09 19:46 - 2015-02-09 23:46 - 00002236 _____ () C:\WINDOWS\PFRO.log
2015-02-09 19:44 - 2015-02-11 22:36 - 00000000 ____D () C:\AdwCleaner
2015-02-09 19:35 - 2015-02-09 19:35 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-09 18:38 - 2015-02-16 20:21 - 00000000 ____D () C:\FRST
2015-02-09 18:38 - 2015-02-09 18:39 - 00045314 _____ () C:\Users\WoJa\Downloads\FRST.txt
2015-02-09 18:38 - 2015-02-09 18:38 - 00024874 _____ () C:\Users\WoJa\Downloads\Addition.txt
2015-02-09 18:36 - 2015-02-09 18:37 - 02132992 _____ (Farbar) C:\Users\WoJa\Downloads\FRST64.exe
2015-02-08 12:12 - 2015-02-08 12:12 - 00055311 _____ () C:\Users\WoJa\Desktop\default.html
2015-02-08 08:48 - 2015-02-08 08:48 - 00000000 ____D () C:\Users\WoJa\AppData\Local\IsolatedStorage
2015-02-07 15:29 - 2015-02-16 19:49 - 00012970 _____ () C:\WINDOWS\setupact.log
2015-02-07 15:29 - 2015-02-07 15:29 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-02-07 13:09 - 2015-02-07 13:09 - 00001880 _____ () C:\Users\K L S K\Desktop\UseNeXT by Tangysoft.lnk
2015-02-07 13:09 - 2015-02-07 13:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UseNeXT
2015-02-07 13:09 - 2015-02-07 13:09 - 00000000 ____D () C:\Program Files (x86)\UseNeXT
2015-02-07 13:04 - 2015-02-07 13:04 - 00002776 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2015-02-07 13:04 - 2015-02-07 13:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-02-07 13:04 - 2015-02-07 13:04 - 00000000 ____D () C:\Program Files\CCleaner
2015-02-07 12:55 - 2015-02-07 12:55 - 05270008 _____ (Tangysoft Ltd. ) C:\Users\WoJa\Downloads\UseNeXTSetup_5.64(1).exe
2015-02-07 12:35 - 2015-02-07 12:35 - 00000000 __SHD () C:\Users\WoJa\AppData\Local\EmieBrowserModeList
2015-02-06 19:52 - 2015-02-06 19:52 - 00000000 ____D () C:\Program Files (x86)\Avanquest update
2015-02-03 17:48 - 2015-02-04 12:09 - 00000581 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass 2.lnk
2015-02-03 17:44 - 2015-02-03 17:44 - 02536151 _____ (Dominik Reichl ) C:\Users\WoJa\Downloads\KeePass-2.28-Setup.exe
2015-01-28 16:37 - 2015-01-28 16:37 - 05270008 _____ (Tangysoft Ltd. ) C:\Users\WoJa\Downloads\UseNeXTSetup_5.64.exe
2015-01-28 08:51 - 2015-01-28 08:51 - 03980064 _____ (TeamViewer) C:\Users\WoJa\Downloads\teamviewer.exe
2015-01-26 20:49 - 2015-01-26 20:49 - 00000000 ___SD () C:\Users\WoJa\Documents\Meine Datenquellen
2015-01-25 17:38 - 2015-02-08 08:48 - 00000000 ____D () C:\Users\WoJa\AppData\Local\Photo Explosion
2015-01-25 17:38 - 2015-01-25 17:38 - 00000125 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2015-01-25 16:56 - 2015-01-25 16:56 - 01525048 _____ (Avanquest Software) C:\Users\WoJa\Downloads\InPixioPhotoFocus3.0_DM.exe
2015-01-25 16:36 - 2015-01-25 16:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avanquest
2015-01-25 16:32 - 2015-01-25 16:35 - 86216328 _____ (Avanquest Software) C:\Users\WoJa\Downloads\Ausschneiden_2.0.3.exe
2015-01-25 16:28 - 2015-02-06 19:54 - 00000000 ____D () C:\Users\K L S K\AppData\Local\Avanquest
2015-01-25 16:26 - 2015-01-25 16:28 - 00000000 ____D () C:\Users\K L S K\AppData\Local\NGPR
2015-01-25 16:26 - 2015-01-25 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InPixio Photo Maximizer
2015-01-25 16:26 - 2015-01-25 16:26 - 00000000 ____D () C:\Program Files (x86)\InPixio Photo Maximizer
2015-01-25 16:15 - 2015-02-07 11:56 - 00000000 ____D () C:\Users\WoJa\AppData\Local\NGPR
2015-01-25 16:15 - 2015-01-25 17:39 - 00000000 ____D () C:\Users\WoJa\AppData\Local\Avanquest
2015-01-25 16:14 - 2015-02-06 19:52 - 00000000 ____D () C:\ProgramData\Avanquest
2015-01-25 16:14 - 2015-01-25 16:58 - 00000000 ____D () C:\Users\Public\Documents\Avanquest Software
2015-01-25 16:14 - 2015-01-25 16:58 - 00000000 ____D () C:\ProgramData\Configuration
2015-01-25 16:14 - 2015-01-25 16:14 - 00000000 ____D () C:\ProgramData\Avanquest Software
2015-01-25 16:10 - 2015-01-25 17:12 - 00000000 ___RD () C:\Users\WoJa\Desktop\Fotobearbeitung
2015-01-25 16:08 - 2015-01-25 16:10 - 42955192 _____ (Avanquest Software) C:\Users\WoJa\Downloads\InPixio_Photo_Maximizer_MLT.exe
2015-01-25 15:35 - 2015-01-25 16:58 - 00000000 ____D () C:\Program Files (x86)\Avanquest
2015-01-25 15:35 - 2015-01-25 15:35 - 01841528 _____ (Avanquest Software) C:\Users\WoJa\Downloads\Foto-Software_Ausschneiden_DE_FT.exe
2015-01-25 14:54 - 2015-01-25 14:54 - 00000000 ____D () C:\ProgramData\PDFEditor
2015-01-25 14:54 - 2015-01-25 14:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2015-01-25 14:54 - 2014-12-16 21:10 - 00096328 _____ (Wondershare Software) C:\WINDOWS\system32\WSMonEditor.dll
2015-01-23 14:34 - 2015-01-23 14:34 - 00020992 _____ () C:\Users\WoJa\Desktop\7,49.ufo

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-16 20:21 - 2014-07-17 13:57 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-02-16 20:21 - 2014-03-24 06:44 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-16 20:10 - 2014-03-21 13:39 - 01294191 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-16 20:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-02-16 19:52 - 2014-03-21 15:06 - 00003946 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{132EB2ED-B4C8-4356-953F-243BB0BA9D63}
2015-02-16 13:52 - 2014-03-22 15:50 - 00000000 ____D () C:\ProgramData\tmp
2015-02-16 12:22 - 2013-05-13 13:44 - 00000870 _____ () C:\WINDOWS\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2015-02-16 11:21 - 2014-03-24 06:44 - 00001142 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-16 09:53 - 2013-11-14 08:26 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-02-16 09:53 - 2013-11-14 08:11 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2015-02-16 09:53 - 2013-11-14 08:11 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2015-02-15 20:17 - 2014-03-21 14:27 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3381209366-1052480604-4067403755-1005
2015-02-15 20:08 - 2014-03-21 14:23 - 00000000 ____D () C:\Users\WoJa\Documents\Youcam
2015-02-15 20:07 - 2015-01-16 06:45 - 00000000 ___RD () C:\Users\WoJa\Dropbox
2015-02-15 20:07 - 2015-01-16 06:44 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\Dropbox
2015-02-15 20:07 - 2014-03-31 16:06 - 00000000 ____D () C:\Users\WoJa\AppData\Local\FreePDF_XP
2015-02-15 20:07 - 2014-03-24 06:46 - 00000000 ___RD () C:\Users\WoJa\Google Drive
2015-02-15 20:07 - 2014-03-21 14:22 - 00000000 __RDO () C:\Users\WoJa\SkyDrive
2015-02-15 20:07 - 2014-03-21 14:19 - 00701401 _____ () C:\ProgramData\lxeb.log
2015-02-15 20:07 - 2014-03-21 11:05 - 00101382 _____ () C:\ProgramData\lxebscan.log
2015-02-15 20:07 - 2013-05-13 13:44 - 00000868 _____ () C:\WINDOWS\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2015-02-15 20:06 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-15 20:06 - 2013-08-22 14:25 - 02097152 ___SH () C:\WINDOWS\system32\config\BBI
2015-02-15 19:46 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-02-14 20:47 - 2014-03-22 16:21 - 02145280 ___SH () C:\Users\WoJa\Desktop\Thumbs.db
2015-02-14 12:32 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-02-14 10:51 - 2014-05-16 20:33 - 00000000 ___RD () C:\Users\WoJa\Desktop\Schulungen
2015-02-14 10:14 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-02-13 21:02 - 2014-11-15 20:10 - 00000000 ____D () C:\Users\WoJa\Desktop\Pressemeldungen_LaSi
2015-02-13 20:47 - 2014-07-09 21:22 - 00002338 _____ () C:\Users\K L S K\Desktop\Google Chrome.lnk
2015-02-13 13:06 - 2014-04-29 12:40 - 00000000 ____D () C:\Users\WoJa\Documents\Outlook-Dateien
2015-02-13 12:55 - 2014-11-06 20:27 - 00000000 ____D () C:\Users\WoJa\Desktop\Spenner
2015-02-13 11:55 - 2014-07-08 16:20 - 00000519 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.ics
2015-02-13 11:47 - 2014-07-08 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TightVNC
2015-02-13 11:47 - 2014-07-08 16:46 - 00000000 ____D () C:\Program Files\TightVNC
2015-02-13 10:39 - 2015-01-16 06:45 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-02-13 10:37 - 2013-08-22 15:44 - 00511368 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-13 10:36 - 2014-03-21 11:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-12 22:55 - 2013-12-13 10:38 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-02-12 22:52 - 2014-12-12 15:45 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2015-02-12 22:52 - 2014-07-11 21:28 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2015-02-12 22:52 - 2013-04-11 08:30 - 116773704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-02-12 22:10 - 2014-04-20 16:56 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\UseNeXT
2015-02-11 23:20 - 2014-03-27 20:28 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-11 23:20 - 2014-03-21 18:00 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-11 23:20 - 2012-07-26 06:26 - 00000482 _____ () C:\WINDOWS\win.ini
2015-02-11 20:44 - 2014-05-08 15:59 - 00000000 ____D () C:\Users\K L S K\Documents\Youcam
2015-02-11 20:43 - 2013-05-13 14:49 - 00003306 _____ () C:\WINDOWS\System32\Tasks\Intel® Rapid Start Technology Manager
2015-02-10 08:37 - 2014-05-08 16:04 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3381209366-1052480604-4067403755-1008
2015-02-09 19:46 - 2014-06-15 09:24 - 00001102 _____ () C:\Users\K L S K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2015-02-09 19:46 - 2014-06-15 09:24 - 00001072 _____ () C:\Users\K L S K\Desktop\Search.lnk
2015-02-09 12:21 - 2014-06-15 20:07 - 00001226 _____ () C:\Users\K L S K\Desktop\Any Video Converter.lnk
2015-02-09 12:21 - 2014-06-15 20:07 - 00000000 ____D () C:\Users\K L S K\AppData\Roaming\AnvSoft
2015-02-09 10:45 - 2014-05-15 15:47 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\vlc
2015-02-07 13:50 - 2014-03-29 13:47 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\AIMP3
2015-02-07 13:04 - 2014-03-21 20:46 - 00000000 ____D () C:\WINDOWS\Minidump
2015-02-07 13:04 - 2014-03-21 13:33 - 00000000 ___DC () C:\WINDOWS\Panther
2015-02-07 11:52 - 2014-03-21 14:22 - 00000000 ____D () C:\Users\WoJa\AppData\Local\VirtualStore
2015-02-07 11:16 - 2014-03-24 06:44 - 00004118 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 11:16 - 2014-03-24 06:44 - 00003882 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-07 10:56 - 2014-11-27 06:16 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2015-02-07 10:56 - 2014-11-27 06:15 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2015-02-07 10:56 - 2014-11-27 06:15 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2015-02-07 10:56 - 2014-11-27 06:15 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-02-07 10:56 - 2014-11-27 06:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-07 10:56 - 2014-11-27 06:15 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-07 10:56 - 2014-09-27 07:20 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-07 10:55 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\LiveKernelReports
2015-02-06 19:52 - 2013-05-13 13:56 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-05 14:21 - 2014-07-17 13:57 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-02-04 12:11 - 2014-03-27 21:50 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\KeePass
2015-02-03 20:31 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-30 19:47 - 2015-01-13 17:15 - 00000000 ____D () C:\Users\WoJa\Desktop\Schulter-OP
2015-01-30 18:32 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-01-28 14:17 - 2014-03-24 06:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-01-28 08:51 - 2014-09-22 19:10 - 00000000 ____D () C:\Users\WoJa\AppData\Roaming\TeamViewer
2015-01-23 11:24 - 2014-12-16 19:44 - 00000000 ____D () C:\Users\WoJa\Desktop\Steuern

==================== Files in the root of some directories =======

2014-06-13 19:51 - 2014-06-13 19:51 - 0000057 _____ () C:\ProgramData\Ament.ini
2014-03-21 11:09 - 2014-03-21 11:09 - 0000252 _____ () C:\ProgramData\FastPics.log
2014-03-21 14:19 - 2015-02-15 20:07 - 0701401 _____ () C:\ProgramData\lxeb.log
2014-04-19 19:01 - 2014-07-02 10:19 - 0000309 _____ () C:\ProgramData\lxebDiagnostics.log
2014-03-21 11:08 - 2014-06-12 11:20 - 0097172 _____ () C:\ProgramData\lxebJSW.log
2014-03-21 11:05 - 2015-02-15 20:07 - 0101382 _____ () C:\ProgramData\lxebscan.log
2015-01-25 17:38 - 2015-01-25 17:38 - 0000125 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2014-03-21 11:04 - 2014-03-21 11:04 - 0000000 _____ () C:\ProgramData\UpdaterLog.txt
2013-12-13 09:24 - 2013-12-13 09:25 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-12-13 09:22 - 2013-12-13 09:23 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-12-13 09:23 - 2013-12-13 09:24 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log

Some content of TEMP:
====================
C:\Users\WoJa\AppData\Local\Temp\avgnt.exe
C:\Users\WoJa\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpnnfaih.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-12 11:53

==================== End Of Log ============================

--- --- ---
DE]

sunjojo · 17.02.2015, 17:13

Hmm, dann machen wir das jetzt so.

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

FF Extension: WEB.DE MailCheck - C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\toolbar@web.de [2015-02-12]
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\Program Files (x86)\WEB.DE MailCheck

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Wenn der 1. Schritt nicht funktioniert hat, dann setze Firefox zurück:
Nutze zum Zurücksetzen folgende Anleitung: https://support.mozilla.org/de/kb/fi...einfach-loesen

Wenn selbst das Zurücksetzen nichts gebracht hat, dann deinstalliere bitte den Firefox komplett und installiere Firefox danach erneut.

Ist das Problem behoben?

Corsipo · 17.02.2015, 22:40

Hi,

ersten Schritt erledigt. Hier der Log:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-02-2015
Ran by K L S K at 2015-02-17 19:19:35 Run:11
Running from C:\Users\WoJa\Desktop
Loaded Profiles: WoJa & K L S K (Available profiles: Wolfgang & WoJa & K L S K)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
FF Extension: WEB.DE MailCheck - C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\toolbar@web.de [2015-02-12]
2015-02-12 20:14 - 2015-02-12 20:14 - 00000000 ____D () C:\Program Files (x86)\WEB.DE MailCheck
         
*****************

C:\Users\K L S K\AppData\Roaming\Mozilla\Firefox\Profiles\xciieqrs.default\Extensions\toolbar@web.de => Moved successfully.
C:\Program Files (x86)\WEB.DE MailCheck => Moved successfully.

==== End of Fixlog 19:19:35 ====

So,jetzt will ich mal sehen,ob ich den 2. Schritt noch machen muss.

Schöne Grüße nach...?

Corsipo

Ich musste die Restauration von Firefox durchführen, da die Fenster weiter munter auf der Seite erschienen.

Jetzt, nach der Restauration scheinen (ich sag es erstmal vorsichtig), die Probleme behoben zu sein.

Ich melde mich später nochmal, nach ausgiebigem Testen!

Bis dahin,

Gruß,

Corsipo

So ihr Lieben,

Firefox ist wieder sauber. Anscheinend hat die Restaurationsfunktion gefruchtet.
Es hat sich kein popup mehr gezeigt.

Ich bedanke mich bei euch für eure unendliche Mühe.
Ich kann euch uneingeschränkt weiter empfehlen.

Danke an Aneri und Jonas!!!

Schöne Grüße an das Team,

Corsipo

sunjojo · 18.02.2015, 19:19

Hallo Corsipo,

schön, dass wir dir helfen konnten

.

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht, damit erhalte ich keine Benachrichtungen über neue Antworten in diesem Thread. Solltest Du das Thema erneut brauchen, schicke mir bitte eine private Nachricht.

Jeder Andere bitte hier klicken und einen eigenen Thread erstellen.

16.02.2015, 20:11	#64
sunjojo /// Malwareteam	Nach download von avc-577free.exe werde ich mit Pop-ups überschüttet Hmm, ok. Wird die Werbung nur im Firefox angezeigt, oder auch in anderen Browsern? Mach nochmal ein neues FRST Logfile. __________________ Gruß, Jonas

Nach download von avc-577free.exe werde ich mit Pop-ups überschüttet

Plagegeister aller Art und deren Bekämpfung: Nach download von avc-577free.exe werde ich mit Pop-ups überschüttet