Hallo zusammen,

ich habe vor kurzem meinen Rechner auch Viren und Maleware überprüft. Malewarebytes hat etwas gefunden. Dieses habe ich in die Quarantäne verschoben und gelöscht. Seitdem bekomme ich beim Starten einen Bluescreen. Außerdem ist der Rechner sehr langsam, wenn er läuft.

Hier kommen alle Daten:
Prozessor: Intelcore i3 380M 2,53 GHz
Arbeitsspeicher 4GB
Grafik: ATI Mobility Radeon HD 5730
Betriebssystem: Win7 Premium Home 64 Bit

FRST:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015
Ran by Jeanette (administrator) on KASSIOPEIA on 11-02-2015 09:53:28
Running from C:\Users\Jeanette\Desktop
Loaded Profiles: Jeanette (Available profiles: Jeanette & Christoph & Finja)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\mDNSResponder.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNotifier.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\tunmgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\BbDevMgr.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynBtnAsst.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlideNavVDM.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNavigator.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Mozilla Corporation) C:\Program Files (x86)\Internet\Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11725928 2010-12-23] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2010-12-10] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2101032 2010-05-03] (Synaptics Incorporated)
HKLM\...\Run: [SynBtnAsst] => C:\Program Files\Synaptics\SynTP\SynBtnAsst.exe [54568 2010-05-03] (Synaptics Incorporated)
HKLM\...\Run: [OnekeyStudio] => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [789920 2011-05-17] (Lenovo)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4448704 2010-03-11] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [7056832 2010-03-11] (Lenovo (Beijing) Limited)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [MuteSync] => C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe [336384 2009-12-28] (Lenovo)
HKLM-x32\...\Run: [Lenovo SplitScreen] => C:\Program Files\Lenovo\Lenovo SplitScreen\SplitScreen\AutoRunSpS.exe [778592 2010-06-23] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] => c:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => c:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2010-02-03] (CyberLink Corp.)
HKLM-x32\...\Run: [Lenovo SlideNav2] => C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlideNavVDM.exe [318400 2009-12-30] (Lenovo)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [74752 2011-10-26] (Nullsoft, Inc.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443408 2013-09-09] (Research In Motion Limited)
HKLM-x32\...\Run: [RIM PeerManager] => C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [4424704 2013-11-05] (Research In Motion Limited)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [703888 2013-06-19] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2014-10-14] (Microsoft Corporation)
HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1942720 2015-01-23] (Valve Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\REALTEK 11n USB Wireless LAN Utility.lnk
ShortcutTarget: REALTEK 11n USB Wireless LAN Utility.lnk -> C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
Startup: C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe (No File)
Startup: C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-884760279-2294033944-2841522718-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-884760279-2294033944-2841522718-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-884760279-2294033944-2841522718-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPBDE042E6-0BAD-4323-A6C5-2B2CAAB01454&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-884760279-2294033944-2841522718-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKU\S-1-5-21-884760279-2294033944-2841522718-1000 -> {94bd6970-1a83-41dc-9be5-bf50b3d0238f} URL = 
BHO: avast! Online Security -> {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll No File
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll No File
Toolbar: HKLM-x32 - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files (x86)\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH)
DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\3kpso6nv.default-1387541310027
FF DefaultSearchEngine: Google
FF Homepage: www.google.de
FF Keyword.URL: 
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 -> C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\TV\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @zylom.com/ZylomGamesPlayer -> C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Yahoo! Toolbar - C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\3kpso6nv.default-1387541310027\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2015-02-10]
FF Extension: NoScript - C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\3kpso6nv.default-1387541310027\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-02-08]
FF Extension: Adblock Plus - C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\3kpso6nv.default-1387541310027\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-08]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012-01-09]
FF HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-03-03]
FF HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Internet\Firefox\firefox.exe

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R3 BlackBerry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2013-09-09] (Research In Motion Limited) [File not signed]
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [873248 2010-01-12] (Broadcom Corporation.)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
S3 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-15] (Lenovo Group Limited)
S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [509192 2009-08-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [575304 2009-11-17] (Lenovo Group Limited)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)
S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-15] (Lenovo Group Limited)
R2 RIM MDNS; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [389632 2013-11-05] (Apple Inc.) [File not signed]
R2 RIM Tunnel Service; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [1286656 2013-11-05] (Research In Motion Limited) [File not signed]
R2 Slidebar Notifier Service; C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNotifier.exe [69568 2009-12-30] (Lenovo)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 acedrv07; C:\windows\system32\drivers\acedrv07.sys [125440 2013-01-13] () [File not signed]
R1 acedrv09; C:\windows\system32\drivers\acedrv09.sys [134880 2014-06-06] ()
S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [368832 2009-11-05] (AfaTech                  )
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)
S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)
S3 ezplay; C:\Windows\System32\Drivers\ezplay.sys [118400 2011-10-06] (VSO Software)
R1 HWiNFO32; C:\windows\system32\drivers\HWiNFO64A.SYS [26528 2015-01-16] (REALiX(tm))
R3 JmUsbCcgp; C:\Windows\System32\DRIVERS\jmccgp.sys [17904 2010-02-05] (JMicron Technology Corp.)
R3 JmUsbVideo; C:\Windows\System32\Drivers\jmcam.sys [56688 2010-02-05] (JMicron Technology Corp.)
R3 JmUsbVideo2; C:\Windows\System32\Drivers\jmcam_lo.sys [31088 2010-02-05] (JMicron Technology Corp.)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [79872 2013-06-27] (Research In Motion Limited)
R3 rimvndis; C:\Windows\System32\Drivers\rimvndis6_AMD64.sys [17920 2013-11-05] (Research in Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [113704 2008-10-21] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [19496 2008-10-21] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [152616 2008-10-21] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [133160 2008-10-21] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [34856 2008-10-21] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [128552 2008-10-21] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [145960 2008-10-21] (MCCI Corporation)
S3 usbrndis6; C:\Windows\system32\drivers\usb80236.sys [19968 2013-02-12] (Microsoft Corporation)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-06-19] (Cisco Systems, Inc.)
R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)
U3 BcmSqlStartupSvc; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U2 IviRegMgr; No ImagePath
U2 RichVideo; No ImagePath
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
U3 SQLWriter; No ImagePath
S3 zlportio; \??\C:\Program Files (x86)\UltraStar\zlportio.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-11 09:53 - 2015-02-11 09:54 - 00026210 _____ () C:\Users\Jeanette\Desktop\FRST.txt
2015-02-11 09:51 - 2015-02-11 09:52 - 00000000 ____D () C:\Users\Jeanette\Desktop\crash
2015-02-11 09:51 - 2015-02-11 09:51 - 00048480 _____ () C:\Users\Jeanette\Desktop\bluescreens.txt
2015-02-11 09:50 - 2015-02-11 09:50 - 00067310 _____ () C:\Users\Jeanette\Downloads\bluescreenview_v1.55.zip
2015-02-11 09:50 - 2015-02-11 09:50 - 00000000 ____D () C:\Users\Jeanette\Downloads\bluescreenview_v1.55
2015-02-11 09:23 - 2015-02-11 09:23 - 00000478 _____ () C:\Users\Jeanette\Desktop\defogger_disable.log
2015-02-11 09:23 - 2015-02-11 09:23 - 00000000 _____ () C:\Users\Jeanette\defogger_reenable
2015-02-11 09:08 - 2015-02-11 09:08 - 00270952 _____ () C:\windows\Minidump\021115-101260-01.dmp
2015-02-11 08:31 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\windows\system32\perftrack.dll
2015-02-11 08:31 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\wdi.dll
2015-02-11 08:31 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\windows\system32\powertracker.dll
2015-02-11 08:31 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdi.dll
2015-02-11 08:19 - 2015-02-11 08:19 - 00001780 _____ () C:\Users\Jeanette\Desktop\Problemberichterstattung.txt
2015-02-11 08:05 - 2015-02-11 08:06 - 00270888 _____ () C:\windows\Minidump\021115-61869-01.dmp
2015-02-10 22:25 - 2015-02-10 22:25 - 00000000 ____D () C:\d0cb5eb160bce8c232
2015-02-10 22:03 - 2015-02-10 22:03 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Avira
2015-02-10 21:49 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-02-10 21:49 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-02-10 21:49 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe
2015-02-10 21:49 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-02-10 21:49 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-02-10 21:49 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-02-10 21:49 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-02-10 21:49 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-02-10 21:49 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-02-10 21:49 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-02-10 21:49 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-02-10 21:49 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-02-10 21:49 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-02-10 21:49 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-02-10 21:49 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-10 21:49 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-02-10 21:49 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-02-10 21:49 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-02-10 21:49 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-02-10 21:48 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-02-10 21:48 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-02-10 21:48 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-02-10 21:48 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-02-10 21:48 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-02-10 21:48 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-02-10 21:48 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-02-10 21:48 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-02-10 21:48 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-02-10 21:48 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-02-10 21:48 - 2015-01-12 03:33 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-02-10 21:48 - 2015-01-12 03:32 - 06041088 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-02-10 21:48 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-02-10 21:48 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-02-10 21:48 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-02-10 21:48 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-02-10 21:48 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-02-10 21:48 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-02-10 21:48 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-02-10 21:48 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-02-10 21:48 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-02-10 21:48 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-02-10 21:48 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-02-10 21:48 - 2015-01-12 02:55 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-02-10 21:48 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-02-10 21:48 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-02-10 21:48 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-02-10 21:48 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-02-10 21:48 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-02-10 21:48 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-02-10 21:48 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-02-10 21:48 - 2015-01-12 02:29 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-02-10 21:48 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-02-10 21:48 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-02-10 21:48 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-02-10 21:48 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-02-10 21:48 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-02-10 21:48 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-02-10 21:48 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-02-10 21:48 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-02-10 21:47 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-02-10 21:47 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-02-10 21:47 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-02-10 21:47 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-02-10 21:47 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-02-10 21:47 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-02-10 21:47 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-02-10 21:47 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-02-10 21:47 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-02-10 21:47 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-02-10 21:47 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-02-10 21:47 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-02-10 21:47 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-02-10 21:47 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-02-10 21:47 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-02-10 21:47 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-02-10 21:47 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-02-10 21:47 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-02-10 21:47 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-02-10 21:47 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-02-10 21:46 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-02-10 21:46 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2015-02-10 21:46 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2015-02-10 21:46 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2015-02-10 21:46 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2015-02-10 21:46 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2015-02-10 21:45 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-02-10 21:45 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-02-10 21:45 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-02-10 21:45 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-02-10 21:45 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-02-10 21:45 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-02-10 21:45 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-02-10 21:45 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2015-02-10 21:45 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2015-02-10 21:43 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
2015-02-10 21:43 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\windows\SysWOW64\scesrv.dll
2015-02-10 21:40 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-02-10 21:21 - 2015-02-10 21:16 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2015-02-10 21:14 - 2014-11-24 10:23 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2015-02-10 21:14 - 2014-11-24 10:23 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2015-02-10 21:14 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2015-02-10 20:54 - 2015-02-10 20:54 - 00000000 ____D () C:\OETemp
2015-02-10 20:37 - 2015-01-24 13:09 - 00272296 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2015-02-10 20:36 - 2015-01-24 13:09 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2015-02-10 20:36 - 2015-01-24 13:09 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2015-02-10 20:36 - 2015-01-24 13:09 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-10 20:17 - 2015-02-10 20:17 - 00278144 _____ () C:\windows\Minidump\021015-46925-01.dmp
2015-02-09 21:34 - 2015-02-10 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-09 21:34 - 2015-02-10 21:14 - 00000000 ____D () C:\ProgramData\Avira
2015-02-09 21:34 - 2015-02-10 21:14 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-09 21:34 - 2015-02-09 21:34 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2015-02-09 21:34 - 2015-02-09 21:34 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-09 21:00 - 2015-02-09 21:00 - 00272216 _____ () C:\windows\Minidump\020915-33306-01.dmp
2015-02-09 20:23 - 2015-02-09 20:23 - 00380416 _____ () C:\Users\Jeanette\Desktop\Gmer-19357(1).exe
2015-02-09 20:15 - 2015-02-11 09:53 - 00000000 ____D () C:\FRST
2015-02-09 20:14 - 2015-02-09 20:14 - 02132992 _____ (Farbar) C:\Users\Jeanette\Desktop\FRST64.exe
2015-02-09 20:14 - 2015-02-09 20:14 - 00050477 _____ () C:\Users\Jeanette\Desktop\Defogger.exe
2015-02-09 14:50 - 2015-02-09 14:50 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Jeanette\Downloads\avira_de_av_5839340206__ws.exe
2015-02-08 18:08 - 2015-02-10 22:06 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster
2015-02-08 18:08 - 2015-02-08 18:08 - 00448512 _____ (OldTimer Tools) C:\Users\Jeanette\Downloads\TFC.exe
2015-02-08 18:08 - 2015-02-08 18:08 - 00001079 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk
2015-02-08 18:08 - 2015-02-08 18:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2015-02-08 18:08 - 2009-03-24 12:52 - 00129872 _____ (Microsoft Corporation) C:\windows\SysWOW64\MSSTDFMT.DLL
2015-02-08 17:58 - 2015-02-08 18:09 - 42096984 _____ (Apple Inc.) C:\Users\Jeanette\Downloads\QuickTimeInstaller.exe
2015-02-08 17:54 - 2015-02-10 20:37 - 00001484 _____ () C:\windows\SecuniaPackage.log
2015-02-08 10:49 - 2015-02-08 10:54 - 465199132 _____ () C:\Users\Jeanette\Downloads\Die Analphabetin, die rechnen konnte.wma
2015-02-08 10:35 - 2015-02-08 10:35 - 04095448 _____ (BrightFort LLC ) C:\Users\Jeanette\Downloads\spywareblastersetup50.exe
2015-02-08 10:34 - 2015-02-08 10:38 - 372014989 _____ () C:\Users\Jeanette\Downloads\Süßer Tod.wma
2015-02-08 10:31 - 2015-02-08 10:31 - 00543951 _____ () C:\Users\Jeanette\Downloads\noscript-2.6.9.12.xpi.zip
2015-02-08 10:24 - 2015-02-08 10:24 - 05490752 _____ (Secunia) C:\Users\Jeanette\Downloads\PSISetup10004.exe
2015-02-07 22:00 - 2015-02-07 22:23 - 129967104 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_05.wma
2015-02-07 21:37 - 2015-02-07 22:01 - 125126544 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_04.wma
2015-02-07 21:10 - 2015-02-07 22:01 - 127152408 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_03.wma
2015-02-07 20:38 - 2015-02-07 21:43 - 124427352 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_02.wma
2015-02-07 19:37 - 2015-02-07 20:38 - 405903016 _____ () C:\Users\Jeanette\Downloads\Smaragdgrün - Liebe geht durch alle Zeiten(1).wma
2015-02-07 19:23 - 2015-02-07 21:23 - 130253952 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_01.wma
2015-02-07 16:18 - 2015-02-07 16:26 - 81307064 _____ (Swiss Academic Software) C:\Users\Jeanette\Downloads\Citavi4Setup(1).exe
2015-02-02 17:10 - 2015-02-02 17:12 - 00278144 _____ () C:\windows\Minidump\020215-34242-01.dmp
2015-01-31 10:54 - 2015-01-31 10:54 - 00004901 _____ () C:\Users\Jeanette\Downloads\sf535adWBhQ&fs=1&rel=0&autoplay=1
2015-01-29 18:03 - 2015-01-29 18:37 - 00014302 _____ () C:\Users\Jeanette\Documents\Sicherungskopie von Kassenbericht 2014.wbk
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 __SHD () C:\Users\Jeanette\AppData\Local\EmieUserList
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 __SHD () C:\Users\Jeanette\AppData\Local\EmieSiteList
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 __SHD () C:\Users\Jeanette\AppData\Local\EmieBrowserModeList
2015-01-24 13:07 - 2015-01-24 13:07 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\pcwJavaUpdate
2015-01-24 13:06 - 2015-01-24 13:06 - 00017787 _____ () C:\Users\Jeanette\Downloads\pcwJavaUpdater_103.zip
2015-01-21 15:40 - 2015-02-10 21:01 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-21 15:39 - 2015-01-21 15:39 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-21 15:39 - 2015-01-21 15:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-21 15:39 - 2015-01-21 15:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-21 15:39 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-01-21 15:39 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-01-21 15:39 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-01-21 15:35 - 2015-01-21 15:35 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Jeanette\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-20 16:47 - 2015-01-24 13:35 - 00000000 ____D () C:\windows\erdnt
2015-01-20 16:33 - 2015-01-24 13:41 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-20 16:32 - 2015-01-20 16:32 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jeanette\Downloads\revosetup95.exe
2015-01-16 17:38 - 2015-01-16 17:41 - 00000000 ____D () C:\Program Files\HWiNFO64
2015-01-16 17:38 - 2015-01-16 17:38 - 00026528 _____ (REALiX(tm)) C:\windows\system32\Drivers\HWiNFO64A.SYS
2015-01-16 17:38 - 2015-01-16 17:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HWiNFO64
2015-01-16 17:37 - 2015-01-16 17:37 - 02699320 _____ (Martin Malík - REALiX ) C:\Users\Jeanette\Downloads\hw64_448.exe
2015-01-16 12:15 - 2015-01-16 12:15 - 00380416 _____ () C:\Users\Jeanette\Downloads\Gmer-19357.exe
2015-01-16 11:52 - 2015-01-16 11:52 - 01353682 _____ () C:\Users\Jeanette\Downloads\hwmonitor_1.26.zip
2015-01-16 11:52 - 2015-01-16 11:52 - 00000000 ____D () C:\Users\Jeanette\Downloads\hwmonitor_1.26
2015-01-16 11:51 - 2015-01-16 18:04 - 00000000 ____D () C:\Users\Jeanette\Downloads\hwmonitor_1.24
2015-01-16 11:51 - 2015-01-16 11:51 - 01211573 _____ () C:\Users\Jeanette\Downloads\hwmonitor_1.24.zip
2015-01-16 11:44 - 2015-01-16 11:44 - 00141480 _____ () C:\Users\Jeanette\Downloads\bluescreenview_152setup.exe
2015-01-16 11:44 - 2015-01-16 11:44 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2015-01-16 11:44 - 2015-01-16 11:44 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2015-01-16 11:31 - 2015-01-16 11:31 - 00278144 _____ () C:\windows\Minidump\011615-38547-01.dmp
2015-01-16 06:42 - 2015-01-16 06:42 - 00278144 _____ () C:\windows\Minidump\011615-37627-01.dmp
2015-01-15 21:08 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-15 20:55 - 2015-01-15 20:56 - 00278144 _____ () C:\windows\Minidump\011515-118217-01.dmp
2015-01-15 19:32 - 2015-01-15 19:32 - 00278144 _____ () C:\windows\Minidump\011515-36270-01.dmp
2015-01-15 18:56 - 2015-01-15 18:59 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Jeanette\Downloads\mbam-setup-majorgeeks-2.0.4.1028.exe
2015-01-15 18:51 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-15 18:51 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-15 18:51 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-15 18:51 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll
2015-01-15 18:51 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-11 09:54 - 2009-07-14 05:45 - 00019296 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-11 09:54 - 2009-07-14 05:45 - 00019296 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-11 09:53 - 2011-05-17 16:16 - 01361518 _____ () C:\windows\WindowsUpdate.log
2015-02-11 09:51 - 2012-04-01 12:03 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-11 09:23 - 2011-06-05 09:16 - 00000000 ____D () C:\Users\Jeanette
2015-02-11 09:18 - 2013-12-09 16:03 - 00000000 ___RD () C:\Users\Jeanette\Dropbox
2015-02-11 09:18 - 2013-12-09 15:59 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Dropbox
2015-02-11 09:15 - 2014-12-29 11:51 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-02-11 09:15 - 2012-04-01 12:03 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-11 09:08 - 2013-12-07 17:32 - 00038017 _____ () C:\windows\setupact.log
2015-02-11 09:08 - 2011-09-18 14:01 - 00000000 ____D () C:\windows\Minidump
2015-02-11 09:08 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-11 09:07 - 2014-02-27 18:24 - 416084502 _____ () C:\windows\MEMORY.DMP
2015-02-11 09:07 - 2013-12-08 15:22 - 01070476 _____ () C:\windows\PFRO.log
2015-02-11 08:56 - 2014-12-11 14:06 - 00000000 ____D () C:\windows\system32\appraiser
2015-02-11 08:56 - 2014-07-09 16:41 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-02-11 08:56 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\tracing
2015-02-11 08:54 - 2011-08-19 10:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-11 08:54 - 2009-07-14 03:34 - 00000478 _____ () C:\windows\win.ini
2015-02-11 08:47 - 2011-11-27 14:43 - 00000000 ____D () C:\Users\Jeanette\Documents\Outlook-Dateien
2015-02-11 08:11 - 2013-12-09 16:00 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-02-11 08:05 - 2009-07-14 05:45 - 00459784 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-10 22:24 - 2013-07-16 21:55 - 00000000 ____D () C:\windows\system32\MRT
2015-02-10 22:13 - 2011-06-08 20:03 - 116773704 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-02-10 22:06 - 2011-05-17 16:43 - 00000000 ____D () C:\ProgramData\Temp
2015-02-10 20:43 - 2013-12-20 13:12 - 00007603 _____ () C:\Users\Jeanette\AppData\Local\Resmon.ResmonCfg
2015-02-10 20:36 - 2011-06-06 11:20 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-08 18:09 - 2012-09-28 11:28 - 00000000 ____D () C:\ProgramData\Licenses
2015-02-08 10:56 - 2013-11-27 19:23 - 00000000 ____D () C:\Users\Jeanette\Documents\Citavi 4
2015-02-08 10:22 - 2014-12-19 22:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverWhiz
2015-02-08 10:16 - 2011-05-17 23:46 - 00699682 _____ () C:\windows\system32\perfh007.dat
2015-02-08 10:16 - 2011-05-17 23:46 - 00149790 _____ () C:\windows\system32\perfc007.dat
2015-02-08 10:16 - 2009-07-14 06:13 - 01620684 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-07 16:57 - 2014-11-26 15:59 - 00001949 _____ () C:\Users\Public\Desktop\Citavi 4.lnk
2015-02-07 16:57 - 2013-11-27 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citavi 4
2015-02-07 16:57 - 2012-01-09 19:12 - 00000000 ____D () C:\ProgramData\Swiss Academic Software
2015-02-07 16:51 - 2011-09-10 11:23 - 00000000 ____D () C:\Users\Jeanette\AppData\Local\Downloaded Installations
2015-02-07 15:46 - 2012-04-01 12:03 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 15:46 - 2012-04-01 12:03 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-04 08:06 - 2009-07-14 06:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2015-02-04 08:05 - 2011-12-13 12:33 - 00001421 _____ () C:\Users\Finja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-28 17:12 - 2012-08-28 09:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 20:26 - 2011-06-06 09:53 - 00000000 ____D () C:\Program Files (x86)\Internet
2015-01-24 13:40 - 2013-12-14 13:02 - 00001616 _____ () C:\DelFix.txt
2015-01-24 13:09 - 2013-11-12 14:35 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-24 13:09 - 2013-11-12 14:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-20 17:24 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-01-20 17:13 - 2009-07-14 03:34 - 00000215 _____ () C:\windows\system.ini
2015-01-20 17:11 - 2009-07-14 03:34 - 97255424 _____ () C:\windows\system32\config\software.bak
2015-01-20 17:11 - 2009-07-14 03:34 - 24641536 _____ () C:\windows\system32\config\system.bak
2015-01-20 17:11 - 2009-07-14 03:34 - 00524288 _____ () C:\windows\system32\config\default.bak
2015-01-20 17:11 - 2009-07-14 03:34 - 00262144 _____ () C:\windows\system32\config\security.bak
2015-01-20 17:11 - 2009-07-14 03:34 - 00262144 _____ () C:\windows\system32\config\sam.bak
2015-01-20 17:08 - 2011-06-05 20:42 - 00000000 ____D () C:\Users\Christoph
2015-01-20 16:40 - 2011-10-30 19:23 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Winamp
2015-01-16 11:40 - 2011-06-15 09:44 - 00000000 ____D () C:\Users\Jeanette\Documents\Nähen
2015-01-16 11:34 - 2013-08-30 10:12 - 00000000 ____D () C:\Users\Public\Documents\PearlMountain
2015-01-16 11:34 - 2013-06-01 20:05 - 00000000 ____D () C:\Users\Jeanette\Documents\PassionFruit Games
2015-01-16 11:34 - 2011-08-22 09:22 - 00000000 ____D () C:\Users\Public\Documents\Kontoauszüge
2015-01-13 10:39 - 2013-01-20 19:16 - 00000000 ____D () C:\Users\Jeanette\Documents\Martinsverein

==================== Files in the root of some directories =======

2013-12-18 14:28 - 2013-12-18 14:45 - 50063360 _____ () C:\Program Files (x86)\GUTD662.tmp
2011-10-06 08:42 - 2012-02-12 20:33 - 0007833 _____ () C:\Users\Jeanette\AppData\Roaming\ezplay.cat
2011-10-06 08:42 - 2012-02-12 20:33 - 0001127 _____ () C:\Users\Jeanette\AppData\Roaming\ezplay.inf
2011-10-06 08:42 - 2011-10-06 08:42 - 0000125 _____ () C:\Users\Jeanette\AppData\Roaming\ezplay.ini
2011-10-06 08:43 - 2012-02-12 20:33 - 0000033 _____ () C:\Users\Jeanette\AppData\Roaming\ezplay.log
2011-10-06 08:42 - 2012-02-12 20:33 - 0118400 _____ (VSO Software) C:\Users\Jeanette\AppData\Roaming\ezplay.sys
2011-10-06 08:42 - 2012-02-12 20:33 - 0099384 _____ () C:\Users\Jeanette\AppData\Roaming\inst.exe
2012-11-15 14:15 - 2012-11-15 14:15 - 0021887 _____ () C:\Users\Jeanette\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2012-01-02 15:47 - 2012-01-02 15:47 - 0004096 ____H () C:\Users\Jeanette\AppData\Local\keyfile3.drm
2013-11-08 14:22 - 2013-11-08 14:22 - 0005506 _____ () C:\Users\Jeanette\AppData\Local\recently-used.xbel
2013-12-20 13:12 - 2015-02-10 20:43 - 0007603 _____ () C:\Users\Jeanette\AppData\Local\Resmon.ResmonCfg
2011-10-05 14:26 - 2012-04-17 11:47 - 0000040 ___SH () C:\ProgramData\.zreglib
2011-06-05 13:29 - 2011-06-05 13:29 - 0000088 _____ () C:\ProgramData\profile.xml

Some content of TEMP:
====================
C:\Users\Christoph\AppData\Local\Temp\avgnt.exe
C:\Users\Finja\AppData\Local\Temp\avgnt.exe
C:\Users\Jeanette\AppData\Local\Temp\avgnt.exe
C:\Users\Jeanette\AppData\Local\Temp\DRHelper_uninstallComplete.exe
C:\Users\Jeanette\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp2k90hp.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-06 08:30

==================== End Of Log ============================
         

--- --- ---

--- --- ---


Additional:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-02-2015
Ran by Jeanette at 2015-02-11 09:55:33
Running from C:\Users\Jeanette\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Abenteuer Wikinger (HKLM-x32\...\Abenteuer Wikinger) (Version:  - Serious Games Solutions GmbH)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.9.0.1380 - Adobe Systems Incorporated)
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ashampoo Burning Studio 2013 v.11.0.6 (HKLM-x32\...\{91B33C97-0FBA-74AE-E802-D782F5C8AA89}_is1) (Version: 11.0.6 - Ashampoo GmbH & Co. KG)
ATI Catalyst Install Manager (HKLM\...\{1D2A4D59-D4FF-9093-050F-8F042B26E6A1}) (Version: 3.0.782.0 - ATI Technologies, Inc.)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 2004103296.48.56.2755954 - Audible, Inc.)
Audiograbber 1.83 SE  (HKLM-x32\...\Audiograbber) (Version: 1.83 SE  - Audiograbber)
Audiograbber MP3-Plugin (HKLM-x32\...\Audiograbber-Lame) (Version: 1.0 - AG)
Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Bad Piggies (HKLM-x32\...\{32941438-AD79-4EF4-B7E4-86039E41B4D3}) (Version: 1.0.0 - Rovio)
BlackBerry Link (HKLM-x32\...\BlackBerry_10_Desktop) (Version: 1.2.1.31 - BlackBerry Ltd.)
BlackBerry Link (x32 Version: 1.2.1.31 - BlackBerry Ltd.) Hidden
Broadcom 802.11 Wireless Driver (HKLM-x32\...\{8991E763-21F5-4DEA-A938-5D9D77DCB488}) (Version: 1.0.0.0 - )
Broadcom Gigabit NetLink Controller (HKLM\...\{A84DB02B-9C2B-4272-9D2D-A80E00A56513}) (Version: 12.52.01 - Broadcom Corporation)
Cars 2 (HKLM-x32\...\{FF10D622-7BFE-48C6-8DF6-40D8CB1D3C1B}) (Version: 1.00.0000 - Disney Interactive Studios)
ccc-core-static (x32 Version: 2010.0629.2222.38338 - Ihr Firmenname) Hidden
Christmasville (HKLM-x32\...\{D178746E-0919-424E-88A7-81A0E46FF03E}) (Version: 1.00.0000 - Purplehills)
Cinergy T USB XE (MKII) V6.09.28.05b (HKLM-x32\...\Cinergy T USB XE (MKII)) (Version: 6.09.28.05b - )
Cisco AnyConnect Secure Mobility Client  (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.04059 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.04059 - Cisco Systems, Inc.) Hidden
Citavi (HKLM-x32\...\{E12C6653-1FF0-4686-ADB8-589C13AE761F}) (Version: 3.4.0.2 - Swiss Academic Software)
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.5.0.11 - Swiss Academic Software)
Contenta Converter BASIC (HKLM-x32\...\ContentaConverter-BASIC) (Version:  - Contenta Software)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2603 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Demolition Company (HKLM-x32\...\DemolitionCompanyDE_is1) (Version:  - GIANTS Software)
Der Stein der Weisen (HKLM-x32\...\Der Stein der Weisen) (Version:  - )
DEUTSCHLAND SPIELT GAME CENTER (HKLM-x32\...\DSGPlayer) (Version: 1.2010.6.23 - INTENIUM GmbH)
Die 3 Fragezeichen - Unter Verdacht (HKLM-x32\...\Die 3 Fragezeichen - Unter Verdacht) (Version:  - )
Dropbox (HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Dropbox) (Version: 3.2.6 - Dropbox, Inc.)
Energy Management (HKLM-x32\...\{0CE226F3-EB27-4ECD-BBF5-F088716779FD}) (Version: 5.4.1.6 - Lenovo)
Epson Easy Photo Print 2 (HKLM-x32\...\{30E01116-5666-4807-8EF1-D80E9FF16717}) (Version: 2.3.2.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
EPSON PhotoQuicker3.5 (HKLM-x32\...\{65F5B7AF-3363-11D7-BB6B-00018021113F}) (Version:  - )
Epson Print CD (HKLM-x32\...\{D16A31F9-276D-4968-A753-FFEAC56995D0}) (Version: 2.00.00 - SEIKO EPSON CORPORATION)
Eye of the Kraken (HKLM-x32\...\Eye of the Kraken_is1) (Version:  - Absurdus)
Eyesight Challenge (HKLM-x32\...\165-com.novelgames.flashgames.eyesight) (Version: 1.2.0 - Novel Games Limited)
Eyesight Challenge (x32 Version: 1.2.0 - Novel Games Limited) Hidden
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}) (Version: 2.1.27.0 - MAGIX AG)
Flash Games 1.0 (HKLM-x32\...\Flash Games_is1) (Version:  - Free-Soft)
Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)
Free YouTube Download version 3.2.2.430 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.2.430 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.27.225 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.27.225 - DVDVideoSoft Ltd.)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Grace Abenteuer; Die Jagd auf die Kunsträuber (HKLM-x32\...\Grace Abenteuer; Die Jagd auf die Kunsträuber) (Version:  - )
Haeuser bauen mit Willy Werkel (HKLM-x32\...\{7A24E395-6515-4147-8489-3170836A94BB}) (Version: 1.00.0000 - Terzio Verlag)
Holly - Ein Weihnachtsmärchen (HKLM-x32\...\{8F08E12A-363F-4F69-8BC8-0E0EA502A6ED}) (Version: 1.00.0000 - Purplehills)
Holly im Wunderland (HKLM-x32\...\Holly im Wunderland) (Version:  - )
HWiNFO64 Version 4.48 (HKLM\...\HWiNFO64_is1) (Version: 4.48 - Martin Malík - REALiX)
Inkscape 0.48.4 (HKLM-x32\...\Inkscape) (Version: 0.48.4 - )
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Java 7 Update 75 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217075FF}) (Version: 7.0.750 - Oracle)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Laura Jones and the Gates of Good and Evil (HKLM-x32\...\Laura Jones and the Gates of Good and Evil) (Version:  - )
Laura Jones und das geheime Erbe des Nikola Tesla (HKLM-x32\...\Laura Jones und das geheime Erbe des Nikola Tesla) (Version:  - )
LEGO Digital Designer (HKLM-x32\...\New LEGO Digital Designer) (Version:  - LEGO A/S)
LEGO® Harry Potter™: Die Jahre 5-7 (HKLM-x32\...\{5C5A944F-096E-4ADD-B8E8-887F18BA6228}) (Version: 1.0.0.0 - WB Games)
Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.1200 - Broadcom Corporation)
Lenovo DirectShare (HKLM-x32\...\InstallShield_{B2164CCB-C002-4B80-8550-7535D80DF237}) (Version: 1.0.1.38 - ArcSoft)
Lenovo DirectShare (x32 Version: 1.0.1.38 - ArcSoft) Hidden
Lenovo EasyCamera (HKLM-x32\...\{F5608FF7-17C0-440A-80C7-29C48363BD87}) (Version: 1.0.9.2 - Suyin Optronics Corp.)
Lenovo Games Console (HKLM-x32\...\Lenovo Games Console) (Version: 0.38.389.2 - Oberon Media Inc.)
Lenovo MuteSync (HKLM-x32\...\InstallShield_{2955FADE-ADED-44AD-A853-D1EAEA7ACAD5}) (Version: 1.0.0.2 - Lenovo)
Lenovo MuteSync (x32 Version: 1.0.0.2 - Lenovo) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.1230 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 7.0.1230 - CyberLink Corp.) Hidden
Lenovo ReadyComm 5 (HKLM-x32\...\{17542DBF-E17C-4562-BC4D-FA3EF3076C45}) (Version: 5.1.1.22 - Lenovo)
Lenovo ReadyComm 5.0 Service (HKLM-x32\...\{76C66170-C538-4E77-B54D-48E136B5B533}) (Version: 5.0.0.1 - Lenovo Group Limited)
Lenovo SlideNav (HKLM-x32\...\Lenovo SlideNav2) (Version: 2.0.1230.0003 - Lenovo)
Lenovo SplitScreen (HKLM-x32\...\Lenovo SplitScreen) (Version: 1.00.1823.0001 - Lenovo)
Magicians Handbook (HKLM-x32\...\{6850696D-FC0A-48A7-9097-7EB301FB0FEA}) (Version: 1.00.0000 - Purplehills)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Media Go (HKLM-x32\...\{BE4F388F-E7B6-43E8-8856-6B74AC375A87}) (Version: 1.8.121 - Sony)
Mein CEWE FOTOBUCH (HKLM-x32\...\Mein CEWE FOTOBUCH) (Version: 5.0.4 - CEWE COLOR AG u Co. OHG)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mp3tag v2.49 (HKLM-x32\...\Mp3tag) (Version: v2.49 - Florian Heidenreich)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
mufin player 2.0 (HKLM-x32\...\MAGIX_MSI_mufin_player_2) (Version: 2.0.3.680 - mufin GmbH)
mufin player 2.0 (x32 Version: 2.0.3.680 - mufin GmbH) Hidden
Mushroom Age (HKLM-x32\...\Mushroom Age) (Version:  - )
Mysteryville 2 (HKLM-x32\...\{7730D510-6DE2-4CD4-8F58-0B04680AEFE6}) (Version: 1.00.0000 - Mysteryville 2)
NirSoft BlueScreenView (HKLM-x32\...\NirSoft BlueScreenView) (Version:  - )
Onekey Theater (HKLM-x32\...\InstallShield_{D4B060B9-AD4A-4152-9D99-28B93C615AFE}) (Version: 2.0.2.6 - Lenovo)
Onekey Theater (x32 Version: 2.0.2.6 - Lenovo) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
PassbildPro v2.3d (HKLM-x32\...\PassbildPro_is1) (Version:  - PassbildPro)
Pelikan Schulschriften (HKLM-x32\...\Vereinfachte Ausgangsschrift VA_is1) (Version:  - Will Software)
Picture Collage Maker Pro 3.3.9 (HKLM-x32\...\{6D308A90-6C14-4A02-9B04-CB0EF17894A9}_is1) (Version: 3.3.9 - PearlMountain Technology Co., Ltd)
Pingus (HKLM-x32\...\Pingus) (Version: 0.7.2 - )
Pingvinas 1.4.4 (HKLM-x32\...\Pingvinas_is1) (Version: 1.4.4 - Tivola Publishing GmbH)
PlayStation(R)Network Downloader (HKLM-x32\...\{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}) (Version: 2.06.00741 - Sony Computer Entertainment Inc.)
PlayStation(R)Store (HKLM-x32\...\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}) (Version: 4.3.3.12540 - Sony Computer Entertainment Inc.)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.4809d4 - CyberLink Corp.)
PowerXpressHybrid (x32 Version: 1.00.0000 - Ihr Firmenname) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version:  - )
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6121 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6278 - Realtek Semiconductor Corp.)
Ritter Arthur II - Collectors Edition (HKLM-x32\...\Ritter Arthur II - Collectors Edition) (Version: 1.0.0.0 - INTENIUM GmbH)
Schach & Matt (HKLM-x32\...\Schach & Matt_is1) (Version:  - Tivola Development GmbH)
Sea3D 1.2.0a (HKLM-x32\...\Sea3D_is1) (Version: 1.2.0a - Jason Fugate)
Sealegends - Geisterhaftes Licht (HKLM-x32\...\Sealegends - Geisterhaftes Licht) (Version:  - )
Secret Maryo Chronicles (HKLM-x32\...\secretmaryo) (Version: 1.7 - Florian Richter)
SecuROM Diagnostic Tool (HKLM-x32\...\SecuROM Diagnostic Tool) (Version:  - Sony DADC Austria)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Shockwave (HKLM-x32\...\Shockwave) (Version:  - )
Simple Sudoku 4.2 (HKLM-x32\...\Simple Sudoku_is1) (Version:  - )
Snark Busters: Willkommen im Club (HKLM-x32\...\Snark Busters: Willkommen im Club) (Version:  - Alawar Entertainment Inc.)
Sony Ericsson Update Service (HKLM-x32\...\Update Service) (Version: 2.11.9.6 - Sony Ericsson Mobile Communications AB)
Sony PC Companion 2.10.181 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.181 - Sony)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Stellarium 0.10.6.1 (HKLM-x32\...\Stellarium_is1) (Version:  - )
Steuer-Spar-Erklärung 2011 (HKLM-x32\...\{9F5FD796-86F0-4360-85F8-D54C0F5411EB}) (Version: 16.14 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2012 (HKLM-x32\...\{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}) (Version: 17.11 - Wolters Kluwer Deutschland GmbH)
Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.10 - Wolters Kluwer Deutschland GmbH)
SteuerSparErklärung 2014 (HKLM-x32\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.10.89 - Akademische Arbeitsgemeinschaft)
STOPzilla (HKLM-x32\...\{17FE15BF-9656-461F-B9E7-077A9C061955}) (Version: 6.1.55.11 - iS3 Inc.)
StreamTransport version: 1.0.2.2171 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.19.1 - Synaptics Incorporated)
Tales of Monkey Island (HKLM-x32\...\Tales of Monkey Island) (Version: 3.0.0.0 - Daedalic Entertainment)
TerraTec Home Cinema (HKLM-x32\...\{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}) (Version: 6.27.4 - )
The Journey Down: Chapter One (HKLM-x32\...\Steam App 220090) (Version:  - SkyGoblin)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
WGW Deutsch 3 (HKLM-x32\...\{6B56E0F8-762D-46F8-846D-D9609116997E}) (Version: 1.00.0000 - TOPOS)
Winamp (HKLM-x32\...\Winamp) (Version: 5.622  - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
Windows Driver Package - Broadcom Bluetooth  (01/06/2010 6.2.0.9416) (HKLM\...\DFEA59689C004DFD0378309F3A583EA32D78A1B3) (Version: 01/06/2010 6.2.0.9416 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (10/19/2009 5.4.0.1) (HKLM\...\0A4175B489A1B4A6E07E11B063A6263480C51D71) (Version: 10/19/2009 5.4.0.1 - Lenovo)
Zylom Games Player Plugin (HKLM-x32\...\Zylom Games Player Plugin) (Version:  - Zylom Games)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-884760279-2294033944-2841522718-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-884760279-2294033944-2841522718-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-884760279-2294033944-2841522718-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-884760279-2294033944-2841522718-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-884760279-2294033944-2841522718-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-884760279-2294033944-2841522718-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-884760279-2294033944-2841522718-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-884760279-2294033944-2841522718-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-884760279-2294033944-2841522718-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

02-02-2015 17:21:58 Windows-Sicherung
08-02-2015 18:17:41 Installed QuickTime 7
08-02-2015 19:01:18 Windows-Sicherung
10-02-2015 22:10:44 Windows Update
11-02-2015 08:31:30 Windows Update
11-02-2015 08:48:28 Windows Update
11-02-2015 09:43:45 Removed Bonjour

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2015-02-07 15:26 - 00000184 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
129.217.129.34	vpnserver.tu-dortmund.de ###Cisco AnyConnect VPN client modified this file. Please do not modify contents until this comment is removed.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {23A81EB4-1C18-466C-A4D1-A4EE619F95B7} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {4C44B3EE-78E4-4F72-9F15-8777AEF170BE} - System32\Tasks\{0D0787D1-1D42-42AE-9C10-25A49ECFB518} => pcalua.exe -a C:\Users\Jeanette\Downloads\epson327610eu.exe -d "C:\Program Files (x86)\Internet\Firefox"
Task: {61625DAF-1B72-4E0C-8F06-5CE46DBDF145} - System32\Tasks\{B8595506-B271-4D33-BA96-7970A6B1C923} => pcalua.exe -a "C:\Program Files (x86)\Tivola\Der Schatz der Delfine\uninst.exe"
Task: {8D55C888-DCE0-4817-9661-9E1F0945E4A4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-01] (Google Inc.)
Task: {9FD3D689-7F1F-4D5B-B9D2-5D8CEAAF1140} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-01] (Google Inc.)
Task: {B8B9CC00-E87D-4508-891C-6D81D9CE719E} - System32\Tasks\{A844BC1C-5241-4BAA-95C7-2164AAF6DE0C} => pcalua.exe -a F:\Setup.exe -d F:\
Task: {B913AAF9-E10D-4018-9497-5A100C253DB1} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {B9E614BA-448B-4F8F-B9B0-F4B39F5F3B02} - System32\Tasks\{72A6C988-6041-4108-8CDF-F20A877890B1} => pcalua.exe -a C:\Users\Jeanette\Downloads\QuickTimeInstaller(1).exe -d "C:\Program Files (x86)\Internet\Firefox"
Task: {CB208028-0B49-4ADA-930E-81C2926E36DE} - System32\Tasks\{13DB6345-5314-4FFD-976F-B558204B2FCD} => pcalua.exe -a F:\Setup.exe -d F:\
Task: {D7762F0F-CA57-4D69-8C40-9E0DA5AF6992} - System32\Tasks\{493DA952-3CCF-4C4C-ADC7-B84811E71E91} => pcalua.exe -a C:\Users\Jeanette\Downloads\BroeslXP.exe -d C:\Users\Jeanette\Downloads
Task: {E06C6FC6-71BF-4F26-9ACC-515C7E14E32B} - System32\Tasks\{2459E739-ACE0-4B08-9AEC-B344D7575637} => pcalua.exe -a C:\Users\Jeanette\Downloads\FlashGamesFullSetup.exe -d "C:\Program Files (x86)\Internet\Firefox"
Task: {E9D28F9F-7EF0-45F7-815C-1E66C349CD6F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {F9643504-42F4-465C-8869-1C444C61F69C} - System32\Tasks\{7A21C288-75BE-415F-8241-1431C51864E5} => pcalua.exe -a C:\Users\Jeanette\Downloads\epson320037eu.exe -d "C:\Program Files (x86)\Internet\Firefox"
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2010-10-18 15:50 - 2010-10-18 15:50 - 00202144 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect64.dll
2010-10-18 15:52 - 2010-10-18 15:52 - 00156576 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll64.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-12 17:15 - 2010-01-12 17:15 - 00173344 _____ () C:\Program Files\Lenovo\Bluetooth Software\btkeyind.dll
2011-05-17 17:03 - 2009-07-15 16:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2011-05-17 17:03 - 2009-07-15 16:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2011-05-17 16:46 - 2011-05-17 16:46 - 00100256 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
2010-07-08 18:33 - 2010-07-08 18:33 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-06-29 23:21 - 2010-06-29 23:21 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-06-19 11:00 - 2013-06-19 11:00 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2014-12-20 16:28 - 2014-12-20 16:28 - 00170496 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\3d576cbc4ffc5ad06fd61510c5d8f326\IsdiInterop.ni.dll
2011-05-17 16:24 - 2010-03-03 21:08 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2010-10-18 15:46 - 2010-10-18 15:46 - 00161696 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
2010-10-18 15:49 - 2010-10-18 15:49 - 00133024 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
2014-11-11 10:48 - 2014-12-01 22:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-11-11 10:48 - 2014-12-01 22:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-11-11 10:48 - 2014-12-01 22:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-11-11 10:48 - 2014-12-01 22:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-11-11 10:47 - 2014-11-11 19:47 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-01-21 15:27 - 2014-12-02 01:29 - 05002752 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-01-21 15:27 - 2014-12-02 01:29 - 01612800 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-01-21 15:27 - 2014-12-02 01:29 - 01210368 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2014-11-18 12:23 - 2015-01-23 23:34 - 02227904 _____ () C:\Program Files (x86)\Steam\video.dll
2014-11-11 10:48 - 2014-12-01 22:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2014-11-18 12:23 - 2015-01-23 23:33 - 00696512 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2015-02-10 22:00 - 2015-02-10 22:00 - 00750080 _____ () C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-02-11 09:16 - 2015-02-11 09:16 - 00043008 _____ () c:\users\jeanette\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp2k90hp.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00047616 _____ () C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00865280 _____ () C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00200704 _____ () C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2014-11-11 10:48 - 2015-01-16 00:42 - 34641288 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2015-01-27 17:45 - 2015-01-27 17:45 - 03925104 _____ () C:\Program Files (x86)\Internet\Firefox\mozjs.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:5C321E34

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

HKU\S-1-5-21-884760279-2294033944-2841522718-1000\Software\Classes\exefile:  <===== ATTENTION!

==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-884760279-2294033944-2841522718-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-884760279-2294033944-2841522718-500 - Administrator - Disabled)
Christoph (S-1-5-21-884760279-2294033944-2841522718-1003 - Limited - Enabled) => C:\Users\Christoph
Finja (S-1-5-21-884760279-2294033944-2841522718-1008 - Limited - Enabled) => C:\Users\Finja
Gast (S-1-5-21-884760279-2294033944-2841522718-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-884760279-2294033944-2841522718-1010 - Limited - Enabled)
Jeanette (S-1-5-21-884760279-2294033944-2841522718-1000 - Administrator - Enabled) => C:\Users\Jeanette

==================== Faulty Device Manager Devices =============

Name: High Definition Audio-Controller
Description: High Definition Audio-Controller
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: HDAudBus
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: 488: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: ERROR: mDNSPlatformReadTCP - recv: 10053

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: 652: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: ERROR: mDNSPlatformReadTCP - recv: 10053

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: 480: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: ERROR: mDNSPlatformReadTCP - recv: 10053

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: 660: DNSServiceGetAddrInfo      v4v6 BLACKBERRY-47A9.local.

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: 660: Could not write data to client because of error - aborting connection

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: send_msg ERROR: failed to write 89 of 89 bytes to fd 660 errno 10053 (Eine bestehende Verbindung wurde softwaregesteuert
durch den Hostcomputer abgebrochen.)

Error: (02/10/2015 10:10:38 PM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: 560: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)


System errors:
=============
Error: (02/11/2015 09:11:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (02/11/2015 09:09:06 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
acedrv07

Error: (02/11/2015 09:08:44 AM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000050 (0xfffff8a00a265000, 0x0000000000000000, 0xfffff88002f8cc02, 0x0000000000000000)C:\windows\MEMORY.DMP021115-101260-01

Error: (02/11/2015 09:08:32 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Dienst "Bonjour"" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (02/11/2015 09:08:26 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (02/11/2015 08:09:26 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (02/11/2015 08:06:29 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
acedrv07

Error: (02/11/2015 08:06:10 AM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000050 (0xfffff8a00a261000, 0x0000000000000000, 0xfffff88004674c02, 0x0000000000000000)C:\windows\MEMORY.DMP021115-61869-01

Error: (02/11/2015 08:06:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Dienst "Bonjour"" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (02/11/2015 08:05:56 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: 488: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: ERROR: mDNSPlatformReadTCP - recv: 10053

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: 652: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: ERROR: mDNSPlatformReadTCP - recv: 10053

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: 480: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: ERROR: mDNSPlatformReadTCP - recv: 10053

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: 660: DNSServiceGetAddrInfo      v4v6 BLACKBERRY-47A9.local.

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: 660: Could not write data to client because of error - aborting connection

Error: (02/11/2015 02:27:36 AM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: send_msg ERROR: failed to write 89 of 89 bytes to fd 660 errno 10053 (Eine bestehende Verbindung wurde softwaregesteuert
durch den Hostcomputer abgebrochen.)

Error: (02/10/2015 10:10:38 PM) (Source: RIM MDNS) (EventID: 100) (User: )
Description: 560: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)


CodeIntegrity Errors:
===================================
  Date: 2015-02-11 09:07:11.974
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\acedrv07.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-11 09:07:11.740
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\acedrv07.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-11 08:05:21.630
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\acedrv07.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-11 08:05:21.396
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\acedrv07.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-11 06:02:52.394
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\acedrv07.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-11 06:02:52.176
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\acedrv07.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-10 20:47:40.997
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\acedrv07.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-10 20:47:40.747
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\acedrv07.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-10 20:25:37.015
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\acedrv07.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-10 20:25:36.797
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\acedrv07.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3 CPU M 380 @ 2.53GHz
Percentage of memory in use: 52%
Total physical RAM: 3892.48 MB
Available physical RAM: 1851.6 MB
Total Pagefile: 7783.14 MB
Available Pagefile: 5069.16 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:653 GB) (Free:293.61 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:30.69 GB) (Free:30.59 GB) NTFS
Drive f: (Tales of Monkey Island) (CDROM) (Total:3.19 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 8DC0DBDA)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=653 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=30.7 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=14.8 GB) - (Type=12)

==================== End Of Log ============================
         

Delogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:23 on 11/02/2015 (Jeanette)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Gmer:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-11 17:58:50
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD75 rev.02.0 698,64GB
Running: Gmer-19357(1).exe; Driver: C:\Users\Jeanette\AppData\Local\Temp\pxlyqkoc.sys


---- User code sections - GMER 2.1 ----

.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                  00000000773c1401 2 bytes JMP 776ab21b C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                    00000000773c1419 2 bytes JMP 776ab346 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                  00000000773c1431 2 bytes JMP 77728ea9 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                  00000000773c144a 2 bytes CALL 776848ad C:\windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                             * 9
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                     00000000773c14dd 2 bytes JMP 777287a2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                              00000000773c14f5 2 bytes JMP 77728978 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                     00000000773c150d 2 bytes JMP 77728698 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                              00000000773c1525 2 bytes JMP 77728a62 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                    00000000773c153d 2 bytes JMP 7769fca8 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                         00000000773c1555 2 bytes JMP 776a68ef C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                  00000000773c156d 2 bytes JMP 77728f61 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                    00000000773c1585 2 bytes JMP 77728ac2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                       00000000773c159d 2 bytes JMP 7772865c C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                    00000000773c15b5 2 bytes JMP 7769fd41 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                  00000000773c15cd 2 bytes JMP 776ab2dc C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                              00000000773c16b2 2 bytes JMP 77728e24 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe[2348] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                              00000000773c16bd 2 bytes JMP 777285f1 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                    00000000773c1401 2 bytes JMP 776ab21b C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                      00000000773c1419 2 bytes JMP 776ab346 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                    00000000773c1431 2 bytes JMP 77728ea9 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                    00000000773c144a 2 bytes CALL 776848ad C:\windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                             * 9
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                       00000000773c14dd 2 bytes JMP 777287a2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                00000000773c14f5 2 bytes JMP 77728978 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                       00000000773c150d 2 bytes JMP 77728698 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                00000000773c1525 2 bytes JMP 77728a62 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                      00000000773c153d 2 bytes JMP 7769fca8 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                           00000000773c1555 2 bytes JMP 776a68ef C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                    00000000773c156d 2 bytes JMP 77728f61 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                      00000000773c1585 2 bytes JMP 77728ac2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                         00000000773c159d 2 bytes JMP 7772865c C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                      00000000773c15b5 2 bytes JMP 7769fd41 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                    00000000773c15cd 2 bytes JMP 776ab2dc C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                00000000773c16b2 2 bytes JMP 77728e24 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                00000000773c16bd 2 bytes JMP 777285f1 C:\windows\syswow64\kernel32.dll
.text    C:\windows\system32\taskhost.exe[2408] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                                                                        000007fefd9f8ef0 5 bytes JMP 000007fffd9d00b8
.text    C:\windows\system32\taskhost.exe[2408] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA                                                                                                                                                                        000007fefd9fbfd0 5 bytes JMP 000007fffd9d0038
.text    C:\windows\system32\taskhost.exe[2408] C:\windows\system32\ole32.dll!CoCreateInstance                                                                                                                                                                           000007fefddb7490 5 bytes JMP 000007fffd9d0138
.text    C:\windows\system32\taskhost.exe[2408] C:\windows\system32\WINMM.dll!waveOutReset                                                                                                                                                                               000007fefb15a38c 5 bytes JMP 000007fefd9d02b8
.text    C:\windows\system32\taskhost.exe[2408] C:\windows\system32\WINMM.dll!waveOutPause                                                                                                                                                                               000007fefb174b60 5 bytes JMP 000007fefd9d0238
.text    C:\windows\system32\taskhost.exe[2408] C:\windows\system32\WINMM.dll!waveOutRestart                                                                                                                                                                             000007fefb174ba0 5 bytes JMP 000007fefd9d01b8
.text    C:\windows\system32\Dwm.exe[3092] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                                                                             000007fefd9f8ef0 5 bytes JMP 000007fffd9e00b8
.text    C:\windows\system32\Dwm.exe[3092] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA                                                                                                                                                                             000007fefd9fbfd0 5 bytes JMP 000007fffd9e0038
.text    C:\Windows\System32\hkcmd.exe[4088] C:\windows\system32\kernel32.dll!LoadLibraryW                                                                                                                                                                               0000000077a06440 5 bytes JMP 0000000169ff0038
.text    C:\Windows\System32\hkcmd.exe[4088] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                                                                           000007fefd9f8ef0 5 bytes JMP 000007fffd9d00b8
.text    C:\Windows\System32\hkcmd.exe[4088] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA                                                                                                                                                                           000007fefd9fbfd0 5 bytes JMP 000007fffd9d0038
.text    C:\Windows\System32\hkcmd.exe[4088] C:\windows\system32\ole32.dll!CoCreateInstance                                                                                                                                                                              000007fefddb7490 5 bytes JMP 000007fffd9d0138
.text    C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[4160] C:\windows\system32\kernel32.dll!LoadLibraryW                                                                                                                                                 0000000077a06440 5 bytes JMP 0000000169ff0038
.text    C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[4160] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                                             000007fefd9f8ef0 5 bytes JMP 000007fffd9e00b8
.text    C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[4160] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA                                                                                                                                             000007fefd9fbfd0 5 bytes JMP 000007fffd9e0038
.text    C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[4160] C:\windows\system32\WINMM.dll!waveOutReset                                                                                                                                                    000007fefb15a38c 5 bytes JMP 000007fefd9e02b8
.text    C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[4160] C:\windows\system32\WINMM.dll!waveOutPause                                                                                                                                                    000007fefb174b60 5 bytes JMP 000007fefd9e0238
.text    C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[4160] C:\windows\system32\WINMM.dll!waveOutRestart                                                                                                                                                  000007fefb174ba0 5 bytes JMP 000007fefd9e01b8
.text    C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[4160] C:\windows\system32\ole32.dll!CoCreateInstance                                                                                                                                                000007fefddb7490 5 bytes JMP 000007fffd9e0138
.text    C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe[4176] C:\windows\system32\kernel32.dll!LoadLibraryW                                                                                                                                       0000000077a06440 5 bytes JMP 0000000169ff0038
.text    C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe[4176] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                                   000007fefd9f8ef0 5 bytes JMP 000007fffd9e00b8
.text    C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe[4176] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA                                                                                                                                   000007fefd9fbfd0 5 bytes JMP 000007fffd9e0038
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                      00000000773c1401 2 bytes JMP 776ab21b C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                        00000000773c1419 2 bytes JMP 776ab346 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                      00000000773c1431 2 bytes JMP 77728ea9 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                      00000000773c144a 2 bytes CALL 776848ad C:\windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                             * 9
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                         00000000773c14dd 2 bytes JMP 777287a2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                  00000000773c14f5 2 bytes JMP 77728978 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                         00000000773c150d 2 bytes JMP 77728698 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                  00000000773c1525 2 bytes JMP 77728a62 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                        00000000773c153d 2 bytes JMP 7769fca8 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                             00000000773c1555 2 bytes JMP 776a68ef C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                      00000000773c156d 2 bytes JMP 77728f61 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                        00000000773c1585 2 bytes JMP 77728ac2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                           00000000773c159d 2 bytes JMP 7772865c C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                        00000000773c15b5 2 bytes JMP 7769fd41 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                      00000000773c15cd 2 bytes JMP 776ab2dc C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                  00000000773c16b2 2 bytes JMP 77728e24 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4224] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                  00000000773c16bd 2 bytes JMP 777285f1 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                                                                                                                                    00000000776848db 5 bytes JMP 0000000110002710
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                                                                                                                                      00000000776848f3 5 bytes JMP 00000001100027f0
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                                                                                                                                    0000000077684925 5 bytes JMP 0000000110002780
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                                                                     0000000076079d0b 5 bytes JMP 0000000110002850
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                                                                                                                                            00000000773c1401 2 bytes JMP 776ab21b C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!EnumProcessModules + 17                                                                                                                                                              00000000773c1419 2 bytes JMP 776ab346 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!GetModuleInformation + 17                                                                                                                                                            00000000773c1431 2 bytes JMP 77728ea9 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!GetModuleInformation + 42                                                                                                                                                            00000000773c144a 2 bytes CALL 776848ad C:\windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                             * 9
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                                                                                                                                               00000000773c14dd 2 bytes JMP 777287a2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                                                                                                                                                        00000000773c14f5 2 bytes JMP 77728978 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                                                                                                                                               00000000773c150d 2 bytes JMP 77728698 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                                                                                                                                                        00000000773c1525 2 bytes JMP 77728a62 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                                                                                                                                              00000000773c153d 2 bytes JMP 7769fca8 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!EnumProcesses + 17                                                                                                                                                                   00000000773c1555 2 bytes JMP 776a68ef C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                                                                                                                                            00000000773c156d 2 bytes JMP 77728f61 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                                                                                                                                              00000000773c1585 2 bytes JMP 77728ac2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!QueryWorkingSet + 17                                                                                                                                                                 00000000773c159d 2 bytes JMP 7772865c C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                                                                                                                                              00000000773c15b5 2 bytes JMP 7769fd41 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                                                                                                                                            00000000773c15cd 2 bytes JMP 776ab2dc C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                                                                                                                                                        00000000773c16b2 2 bytes JMP 77728e24 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\Steam.exe[4268] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                                                                                                                                                        00000000773c16bd 2 bytes JMP 777285f1 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4292] C:\windows\system32\kernel32.dll!LoadLibraryW                                                                                                                                                       0000000077a06440 5 bytes JMP 0000000169ff0038
.text    C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4292] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                                                   000007fefd9f8ef0 5 bytes JMP 000007fffd9e00b8
.text    C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4292] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA                                                                                                                                                   000007fefd9fbfd0 5 bytes JMP 000007fffd9e0038
.text    C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4292] C:\windows\system32\WINMM.dll!waveOutReset                                                                                                                                                          000007fefb15a38c 5 bytes JMP 000007fefd9e02b8
.text    C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4292] C:\windows\system32\WINMM.dll!waveOutPause                                                                                                                                                          000007fefb174b60 5 bytes JMP 000007fefd9e0238
.text    C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[4292] C:\windows\system32\WINMM.dll!waveOutRestart                                                                                                                                                        000007fefb174ba0 5 bytes JMP 000007fefd9e01b8
.text    C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[4300] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                                           000007fefd9f8ef0 5 bytes JMP 000007fffd9c00b8
.text    C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[4300] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA                                                                                                                                           000007fefd9fbfd0 5 bytes JMP 000007fffd9c0038
.text    C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[4300] C:\windows\system32\ole32.dll!CoCreateInstance                                                                                                                                              000007fefddb7490 5 bytes JMP 000007fffd9c0138
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                                                                                                                 00000000776848db 5 bytes JMP 0000000102232710
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                                                                                                                   00000000776848f3 5 bytes JMP 00000001022327f0
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                                                                                                                 0000000077684925 5 bytes JMP 0000000102232780
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                                                  0000000076079d0b 5 bytes JMP 0000000102232850
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17                                                                                                                                         00000000773c1401 2 bytes JMP 776ab21b C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!EnumProcessModules + 17                                                                                                                                           00000000773c1419 2 bytes JMP 776ab346 C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 17                                                                                                                                         00000000773c1431 2 bytes JMP 77728ea9 C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 42                                                                                                                                         00000000773c144a 2 bytes CALL 776848ad C:\windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                             * 9
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17                                                                                                                                            00000000773c14dd 2 bytes JMP 777287a2 C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17                                                                                                                                     00000000773c14f5 2 bytes JMP 77728978 C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17                                                                                                                                            00000000773c150d 2 bytes JMP 77728698 C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17                                                                                                                                     00000000773c1525 2 bytes JMP 77728a62 C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17                                                                                                                                           00000000773c153d 2 bytes JMP 7769fca8 C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!EnumProcesses + 17                                                                                                                                                00000000773c1555 2 bytes JMP 776a68ef C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17                                                                                                                                         00000000773c156d 2 bytes JMP 77728f61 C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!GetPerformanceInfo + 17                                                                                                                                           00000000773c1585 2 bytes JMP 77728ac2 C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!QueryWorkingSet + 17                                                                                                                                              00000000773c159d 2 bytes JMP 7772865c C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17                                                                                                                                           00000000773c15b5 2 bytes JMP 7769fd41 C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17                                                                                                                                         00000000773c15cd 2 bytes JMP 776ab2dc C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20                                                                                                                                     00000000773c16b2 2 bytes JMP 77728e24 C:\windows\syswow64\kernel32.dll
.text    C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe[4380] C:\windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31                                                                                                                                     00000000773c16bd 2 bytes JMP 777285f1 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4748] C:\windows\syswow64\KERNEL32.dll!LoadLibraryExA                                                                                                                             00000000776848db 5 bytes JMP 0000000110002710
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4748] C:\windows\syswow64\KERNEL32.dll!LoadLibraryW                                                                                                                               00000000776848f3 5 bytes JMP 00000001100027f0
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4748] C:\windows\syswow64\KERNEL32.dll!LoadLibraryExW                                                                                                                             0000000077684925 5 bytes JMP 0000000110002780
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4748] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                              0000000076079d0b 5 bytes JMP 0000000110002850
.text    C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe[4764] C:\windows\system32\KERNEL32.dll!LoadLibraryW                                                                                                                                                  0000000077a06440 5 bytes JMP 0000000169ff0038
.text    C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe[4764] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                                              000007fefd9f8ef0 5 bytes JMP 000007fffd9d00b8
.text    C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe[4764] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA                                                                                                                                              000007fefd9fbfd0 5 bytes JMP 000007fffd9d0038
.text    C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe[4764] C:\windows\system32\ole32.dll!CoCreateInstance                                                                                                                                                 000007fefddb7490 5 bytes JMP 000007fffd9d0138
.text    C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe[4796] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                                                                                                                       00000000776848db 5 bytes JMP 0000000110002710
.text    C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe[4796] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                                                                                                                         00000000776848f3 5 bytes JMP 00000001100027f0
.text    C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe[4796] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                                                                                                                       0000000077684925 5 bytes JMP 0000000110002780
.text    C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe[4796] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                                                        0000000076079d0b 5 bytes JMP 0000000110002850
.text    C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlideNavVDM.exe[4804] C:\windows\system32\kernel32.dll!LoadLibraryW                                                                                                                                   0000000077a06440 5 bytes JMP 0000000169ff0038
.text    C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlideNavVDM.exe[4804] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                               000007fefd9f8ef0 5 bytes JMP 000007fffd9e00b8
.text    C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlideNavVDM.exe[4804] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA                                                                                                                               000007fefd9fbfd0 5 bytes JMP 000007fffd9e0038
.text    C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlideNavVDM.exe[4804] C:\windows\system32\ole32.dll!CoCreateInstance                                                                                                                                  000007fefddb7490 5 bytes JMP 000007fffd9e0138
.text    C:\Program Files (x86)\Winamp\winampa.exe[4824] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                                                                                                                                 00000000776848db 5 bytes JMP 0000000110002710
.text    C:\Program Files (x86)\Winamp\winampa.exe[4824] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                                                                                                                                   00000000776848f3 5 bytes JMP 00000001100027f0
.text    C:\Program Files (x86)\Winamp\winampa.exe[4824] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                                                                                                                                 0000000077684925 5 bytes JMP 0000000110002780
.text    C:\Program Files (x86)\Winamp\winampa.exe[4824] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                                                                  0000000076079d0b 5 bytes JMP 0000000110002850
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                                                                                   00000000776848db 5 bytes JMP 0000000110002710
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                                                                                     00000000776848f3 5 bytes JMP 00000001100027f0
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                                                                                   0000000077684925 5 bytes JMP 0000000110002780
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                    0000000076079d0b 5 bytes JMP 0000000110002850
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                           00000000773c1401 2 bytes JMP 776ab21b C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                             00000000773c1419 2 bytes JMP 776ab346 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                           00000000773c1431 2 bytes JMP 77728ea9 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                           00000000773c144a 2 bytes CALL 776848ad C:\windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                             * 9
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                              00000000773c14dd 2 bytes JMP 777287a2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                       00000000773c14f5 2 bytes JMP 77728978 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                              00000000773c150d 2 bytes JMP 77728698 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                       00000000773c1525 2 bytes JMP 77728a62 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                             00000000773c153d 2 bytes JMP 7769fca8 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                  00000000773c1555 2 bytes JMP 776a68ef C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                           00000000773c156d 2 bytes JMP 77728f61 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                             00000000773c1585 2 bytes JMP 77728ac2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                00000000773c159d 2 bytes JMP 7772865c C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                             00000000773c15b5 2 bytes JMP 7769fd41 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                           00000000773c15cd 2 bytes JMP 776ab2dc C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                       00000000773c16b2 2 bytes JMP 77728e24 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe[4968] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                       00000000773c16bd 2 bytes JMP 777285f1 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                                                                                     00000000776848db 5 bytes JMP 0000000110002710
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                                                                                       00000000776848f3 5 bytes JMP 00000001100027f0
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                                                                                     0000000077684925 5 bytes JMP 0000000110002780
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                      0000000076079d0b 5 bytes JMP 0000000110002850
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                             00000000773c1401 2 bytes JMP 776ab21b C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                               00000000773c1419 2 bytes JMP 776ab346 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                             00000000773c1431 2 bytes JMP 77728ea9 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                             00000000773c144a 2 bytes CALL 776848ad C:\windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                             * 9
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                00000000773c14dd 2 bytes JMP 777287a2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                         00000000773c14f5 2 bytes JMP 77728978 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                00000000773c150d 2 bytes JMP 77728698 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                         00000000773c1525 2 bytes JMP 77728a62 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                               00000000773c153d 2 bytes JMP 7769fca8 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                    00000000773c1555 2 bytes JMP 776a68ef C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                             00000000773c156d 2 bytes JMP 77728f61 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                               00000000773c1585 2 bytes JMP 77728ac2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                  00000000773c159d 2 bytes JMP 7772865c C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                               00000000773c15b5 2 bytes JMP 7769fd41 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                             00000000773c15cd 2 bytes JMP 776ab2dc C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                         00000000773c16b2 2 bytes JMP 77728e24 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe[4984] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                         00000000773c16bd 2 bytes JMP 777285f1 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4996] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                                                                                            00000000776848db 5 bytes JMP 0000000110002710
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4996] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                                                                                              00000000776848f3 5 bytes JMP 00000001100027f0
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4996] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                                                                                            0000000077684925 5 bytes JMP 0000000110002780
.text    C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4996] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                             0000000076079d0b 5 bytes JMP 0000000110002850
.text    C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5020] C:\windows\syswow64\KERNEL32.dll!LoadLibraryExA                                                                                                                                                00000000776848db 5 bytes JMP 0000000110002710
.text    C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5020] C:\windows\syswow64\KERNEL32.dll!LoadLibraryW                                                                                                                                                  00000000776848f3 5 bytes JMP 00000001100027f0
.text    C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5020] C:\windows\syswow64\KERNEL32.dll!LoadLibraryExW                                                                                                                                                0000000077684925 5 bytes JMP 0000000110002780
.text    C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[5040] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                                                                                                                    00000000776848db 5 bytes JMP 0000000110002710
.text    C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[5040] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                                                                                                                      00000000776848f3 5 bytes JMP 00000001100027f0
.text    C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[5040] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                                                                                                                    0000000077684925 5 bytes JMP 0000000110002780
.text    C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNavigator.exe[4100] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                                                                                           00000000776848db 5 bytes JMP 0000000100302710
.text    C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNavigator.exe[4100] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                                                                                             00000000776848f3 5 bytes JMP 00000001003027f0
.text    C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNavigator.exe[4100] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                                                                                           0000000077684925 5 bytes JMP 0000000100302780
.text    C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNavigator.exe[4100] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                            0000000076079d0b 5 bytes JMP 0000000100302850
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                                                                                                                       00000000776848db 5 bytes JMP 0000000110002710
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                                                                                                                         00000000776848f3 5 bytes JMP 00000001100027f0
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                                                                                                                       0000000077684925 5 bytes JMP 0000000110002780
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                               00000000773c1401 2 bytes JMP 776ab21b C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                                 00000000773c1419 2 bytes JMP 776ab346 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                               00000000773c1431 2 bytes JMP 77728ea9 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                               00000000773c144a 2 bytes CALL 776848ad C:\windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                             * 9
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                                  00000000773c14dd 2 bytes JMP 777287a2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                           00000000773c14f5 2 bytes JMP 77728978 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                                  00000000773c150d 2 bytes JMP 77728698 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                           00000000773c1525 2 bytes JMP 77728a62 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                                 00000000773c153d 2 bytes JMP 7769fca8 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                                      00000000773c1555 2 bytes JMP 776a68ef C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                               00000000773c156d 2 bytes JMP 77728f61 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                                 00000000773c1585 2 bytes JMP 77728ac2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                                    00000000773c159d 2 bytes JMP 7772865c C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                                 00000000773c15b5 2 bytes JMP 7769fd41 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                               00000000773c15cd 2 bytes JMP 776ab2dc C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                           00000000773c16b2 2 bytes JMP 77728e24 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                           00000000773c16bd 2 bytes JMP 777285f1 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3764] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                                                        0000000076079d0b 5 bytes JMP 0000000110002850
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                                                                                                                        00000000773c1401 2 bytes JMP 776ab21b C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!EnumProcessModules + 17                                                                                                                                          00000000773c1419 2 bytes JMP 776ab346 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!GetModuleInformation + 17                                                                                                                                        00000000773c1431 2 bytes JMP 77728ea9 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!GetModuleInformation + 42                                                                                                                                        00000000773c144a 2 bytes CALL 776848ad C:\windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                             * 9
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                                                                                                                           00000000773c14dd 2 bytes JMP 777287a2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                                                                                                                                    00000000773c14f5 2 bytes JMP 77728978 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                                                                                                                           00000000773c150d 2 bytes JMP 77728698 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                                                                                                                                    00000000773c1525 2 bytes JMP 77728a62 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                                                                                                                          00000000773c153d 2 bytes JMP 7769fca8 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!EnumProcesses + 17                                                                                                                                               00000000773c1555 2 bytes JMP 776a68ef C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                                                                                                                        00000000773c156d 2 bytes JMP 77728f61 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                                                                                                                          00000000773c1585 2 bytes JMP 77728ac2 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!QueryWorkingSet + 17                                                                                                                                             00000000773c159d 2 bytes JMP 7772865c C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                                                                                                                          00000000773c15b5 2 bytes JMP 7769fd41 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                                                                                                                        00000000773c15cd 2 bytes JMP 776ab2dc C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                                                                                                                                    00000000773c16b2 2 bytes JMP 77728e24 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[4660] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                                                                                                                                    00000000773c16bd 2 bytes JMP 777285f1 C:\windows\syswow64\kernel32.dll
.text    C:\Program Files\McAfee Security Scan\3.8.150\McUicnt.exe[1288] C:\windows\system32\kernel32.dll!LoadLibraryW                                                                                                                                                   0000000077a06440 5 bytes JMP 0000000169ff0038
.text    C:\Program Files\McAfee Security Scan\3.8.150\McUicnt.exe[1288] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                                               000007fefd9f8ef0 5 bytes JMP 000007fffd9c00b8
.text    C:\Program Files\McAfee Security Scan\3.8.150\McUicnt.exe[1288] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA                                                                                                                                               000007fefd9fbfd0 5 bytes JMP 000007fffd9c0038
.text    C:\Program Files\McAfee Security Scan\3.8.150\McUicnt.exe[1288] C:\windows\system32\ole32.dll!CoCreateInstance                                                                                                                                                  000007fefddb7490 5 bytes JMP 000007fffd9c0138
---- Processes - GMER 2.1 ----

Library  C:\Program Files\Bonjour\mdnsNSP.dll (*** suspicious ***) @ C:\windows\system32\svchost.exe [1328]                                                                                                                                                              000000006c670000
Library  C:\Program Files\Bonjour\mdnsNSP.dll (*** suspicious ***) @ C:\windows\System32\spoolsv.exe [1496]                                                                                                                                                              000000006c670000
Library  C:\Program Files\Bonjour\mdnsNSP.dll (*** suspicious ***) @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [1196]                                                                                                                      000000006c670000
Library  C:\Program Files (x86)\Bonjour\mdnsNSP.dll (*** suspicious ***) @ C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2176]                                                                                                         000000006a8a0000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:28)        0000000060af0000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24)            000000005d080000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380](2015-02-10 21:00:30)                                                                                        000000005c370000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24)           000000005bef0000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (ICU I18N DLL/The ICU Project)(2015-02-10 21:00:30)                                                           000000004a900000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (ICU Common DLL/The ICU Project)(2015-02-10 21:00:30)                                                         0000000004320000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (ICU Data DLL/The ICU Project)(2015-02-10 21:00:30)                                                           000000004ad00000
Library  c:\users\jeanette\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp2k90hp.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380](2015-02-11 08:16:44)                                       0000000003e80000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24)        000000005a540000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:26)         0000000059130000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24)          0000000058d20000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24)            0000000058870000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24)            0000000058830000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380](2015-02-10 21:00:30)                                                                                           0000000058710000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:26)  0000000058680000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24)         0000000058640000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-10 21:00:24)   00000000585f0000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380](2015-02-10 21:00:28)                                                                       000000005ce20000
Library  C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe [4380](2015-02-10 21:00:28)                                                                       000000005c6a0000
Library  C:\Program Files (x86)\Bonjour\mdnsNSP.dll (*** suspicious ***) @ C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe [4984]                                                                                                  000000006a8a0000
Library  C:\Program Files (x86)\Bonjour\mdnsNSP.dll (*** suspicious ***) @ C:\Program Files (x86)\Common Files\Steam\SteamService.exe [4660]                                                                                                                             000000006a8a0000

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ec2d88                                                                                                                                                                                     
Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\ec55f9cb8782                                                                                                                                                                                     
Reg      HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ec2d88 (not active ControlSet)                                                                                                                                                                 
Reg      HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\ec55f9cb8782 (not active ControlSet)                                                                                                                                                                 

---- EOF - GMER 2.1 ----
         

Bluesrceens:

==================================================
Dump File         : 021115-101260-01.dmp
Crash Time        : 11.02.2015 08:59:37
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`0a265000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`02f8cc02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+74ec0
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+74ec0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\021115-101260-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 270.952
Dump File Time    : 11.02.2015 09:08:44
==================================================

==================================================
Dump File         : 021115-61869-01.dmp
Crash Time        : 11.02.2015 06:04:12
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`0a261000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`04674c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+74ec0
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+74ec0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\021115-61869-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 270.888
Dump File Time    : 11.02.2015 08:06:10
==================================================

==================================================
Dump File         : 021015-46925-01.dmp
Crash Time        : 10.02.2015 18:58:40
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`16f17000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`02f56c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+76e80
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+76e80
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\021015-46925-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 278.144
Dump File Time    : 10.02.2015 20:17:40
==================================================

==================================================
Dump File         : 020915-33306-01.dmp
Crash Time        : 09.02.2015 20:33:09
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`112c4000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`00c55c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+76e80
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+76e80
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\020915-33306-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 272.216
Dump File Time    : 09.02.2015 21:00:38
==================================================

==================================================
Dump File         : 020215-34242-01.dmp
Crash Time        : 02.02.2015 17:08:03
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`055f7000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`0464ac02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+76e80
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+76e80
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\020215-34242-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 278.144
Dump File Time    : 02.02.2015 17:12:05
==================================================

==================================================
Dump File         : 011615-38547-01.dmp
Crash Time        : 16.01.2015 11:30:04
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`09a1c000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`00e19c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+76e80
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+76e80
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\011615-38547-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 278.144
Dump File Time    : 16.01.2015 11:31:43
==================================================

==================================================
Dump File         : 011615-37627-01.dmp
Crash Time        : 16.01.2015 06:41:02
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`05c86000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`02efbc02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+76e80
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+76e80
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\011615-37627-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 278.144
Dump File Time    : 16.01.2015 06:42:50
==================================================

==================================================
Dump File         : 011515-118217-01.dmp
Crash Time        : 15.01.2015 20:52:44
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`1ee4b000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`04733c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75bc0
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+75bc0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\011515-118217-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 278.144
Dump File Time    : 15.01.2015 20:56:51
==================================================

==================================================
Dump File         : 011515-36270-01.dmp
Crash Time        : 15.01.2015 19:31:08
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`08aa8000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`00c58c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75bc0
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+75bc0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\011515-36270-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 278.144
Dump File Time    : 15.01.2015 19:32:45
==================================================

==================================================
Dump File         : 122014-60122-01.dmp
Crash Time        : 20.12.2014 16:52:20
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`16766000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`046dbc02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75bc0
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+75bc0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\122014-60122-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 278.144
Dump File Time    : 20.12.2014 16:54:39
==================================================

==================================================
Dump File         : 122014-60933-01.dmp
Crash Time        : 20.12.2014 00:12:30
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`06980000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`02f77c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75bc0
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+75bc0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\122014-60933-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 278.144
Dump File Time    : 20.12.2014 00:14:31
==================================================

==================================================
Dump File         : 121914-59389-01.dmp
Crash Time        : 19.12.2014 22:35:41
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`14d09000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`04597c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75c00
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+75c00
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\121914-59389-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 278.144
Dump File Time    : 19.12.2014 22:37:47
==================================================

==================================================
Dump File         : 121914-74318-01.dmp
Crash Time        : 19.12.2014 10:54:36
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`1d5be000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`00c55c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75c00
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+75c00
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\121914-74318-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 278.144
Dump File Time    : 19.12.2014 10:57:03
==================================================

==================================================
Dump File         : 121014-26145-01.dmp
Crash Time        : 10.12.2014 08:05:00
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`0eb09000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`01029c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+6f880
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\121014-26145-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 272.216
Dump File Time    : 10.12.2014 08:39:02
==================================================

==================================================
Dump File         : 102214-29530-01.dmp
Crash Time        : 22.10.2014 14:45:30
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`06f80000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`02f19c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+6f880
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\102214-29530-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 278.144
Dump File Time    : 22.10.2014 14:46:52
==================================================

==================================================
Dump File         : 101714-35396-01.dmp
Crash Time        : 17.10.2014 14:52:50
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`07ab7000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`02f9dc02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+6f880
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\101714-35396-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 278.144
Dump File Time    : 17.10.2014 14:54:37
==================================================

==================================================
Dump File         : 091114-25209-01.dmp
Crash Time        : 10.09.2014 14:17:12
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`05c6d000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`02f09c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+6f880
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\091114-25209-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 278.144
Dump File Time    : 11.09.2014 14:55:13
==================================================

==================================================
Dump File         : 090214-26208-01.dmp
Crash Time        : 02.09.2014 12:12:01
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`06703000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`00dd8c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+6f880
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\090214-26208-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 278.144
Dump File Time    : 02.09.2014 12:13:34
==================================================

==================================================
Dump File         : 081914-29265-01.dmp
Crash Time        : 19.08.2014 17:45:48
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`063ae000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`00e19c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+6f880
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\081914-29265-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 278.144
Dump File Time    : 19.08.2014 17:47:09
==================================================

==================================================
Dump File         : 081914-28282-01.dmp
Crash Time        : 19.08.2014 09:13:51
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`04b37000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`00e83c02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+6f880
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\081914-28282-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 278.144
Dump File Time    : 19.08.2014 09:15:21
==================================================

==================================================
Dump File         : 070114-31621-01.dmp
Crash Time        : 01.07.2014 19:50:43
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`0289e000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`02eebc02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+6f880
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\070114-31621-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 278.144
Dump File Time    : 01.07.2014 19:51:48
==================================================

==================================================
Dump File         : 061914-26925-01.dmp
Crash Time        : 19.06.2014 11:52:10
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`0eb0f000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`01bcbc02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+6f880
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\061914-26925-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 272.216
Dump File Time    : 19.06.2014 11:53:32
==================================================

==================================================
Dump File         : 022714-26504-01.dmp
Crash Time        : 27.02.2014 18:23:38
Bug Check String  : SYSTEM_SERVICE_EXCEPTION
Bug Check Code    : 0x0000003b
Parameter 1       : 00000000`c0000005
Parameter 2       : fffff960`000f6483
Parameter 3       : fffff880`0859d040
Parameter 4       : 00000000`00000000
Caused By Driver  : win32k.sys
Caused By Address : win32k.sys+c6483
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\022714-26504-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 278.144
Dump File Time    : 27.02.2014 18:24:49
==================================================
         

Viele Grüße,
Ennachen

Hi,

Logfile von MBAM bitte mit dem was entfernt wurde.

Den Logfile habe ich leider nicht mehr. Ich habe sie fälschlicherweise gelöscht. Kann ich das im Programm nochmal aufrufen?

Gruß

Wenn Du das Programm öffnest findest Du das Logfile

Ich scheine ein Brett vor dem Kopf zu haben. Ich finde den Logfile nicht. Aber ich habe MalewareBytes erneut laufen lassen. Alles sauber. In den Quarantäne befindet sich noch folgendes: PUP.Optional.Crossrider.A.
Avira findet nichts.
Der Start von Firefox ist sehr langsam. Das sagt sogar Firefox selbst :-)

Gestern nach automatischem Windowsupdate lies sich der Rechner normal starten. Heute jedoch wieder zunächst mit bluescreen.

Sonnige Grüße

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

AdwCleaner:

# AdwCleaner v4.110 - Bericht erstellt 14/02/2015 um 09:17:08
# Aktualisiert 05/02/2015 von Xplode
# Datenbank : 2015-02-14.2 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Jeanette - KASSIOPEIA
# Gestarted von : C:\Users\Jeanette\Downloads\AdwCleaner_4.110.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverWhiz
Ordner Gelöscht : C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\3kpso6nv.default-1387541310027\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
Datei Gelöscht : C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\3kpso6nv.default-1387541310027\invalidprefs.js

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\eSupport.com
Schlüssel Gelöscht : HKCU\Software\DriverWhiz
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.loca

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v35.0.1 (x86 de)

[2kqnp3h2.default\prefs.js] - Zeile Gelöscht : user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");
[zMwPBybD.default\prefs.js] - Zeile Gelöscht : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]
[zMwPBybD.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.MP_DISTINCT_ID", "\"14962264fa19-02539c276628018-41534136-0-14962264fa288\"");
[zMwPBybD.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.SAUTH_expires_at", "1423638472");
[zMwPBybD.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.SAUTH_rndsnr", "\"c25345985856c981214431838a965f8adde3f0b0\"");
[zMwPBybD.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.SAUTH_userid", "5827287965");
[zMwPBybD.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.SAUTH_utoken", "\"a7ad06a3604924c0f2344fadbeb27f9f6c45639d\"");
[zMwPBybD.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.install", "1423033673195");
[zMwPBybD.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.xpiState", "{\"app-profile\":{\"abs@avira.com\":{\"d\":\"C:\\\\Users\\\\Finja\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\zMwPBybD.default\\\\extensions\\\\abs@avi[...]

*************************

AdwCleaner[R0].txt - [2827 Bytes] - [14/02/2015 09:08:56]
AdwCleaner[S0].txt - [2722 Bytes] - [14/02/2015 09:17:08]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2781  Bytes] ##########
         

JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 7 Home Premium x64
Ran by Jeanette on 14.02.2015 at  9:26:13,98
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.02.2015 at  9:31:18,03
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015
Ran by Jeanette (administrator) on KASSIOPEIA on 14-02-2015 09:32:24
Running from C:\Users\Jeanette\Desktop
Loaded Profiles: Jeanette (Available profiles: Jeanette & Christoph & Finja)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\mDNSResponder.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNotifier.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\tunmgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\BbDevMgr.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynBtnAsst.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe
(Dropbox, Inc.) C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Lenovo) C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlideNavVDM.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
() C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNavigator.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11725928 2010-12-23] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2010-12-10] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2101032 2010-05-03] (Synaptics Incorporated)
HKLM\...\Run: [SynBtnAsst] => C:\Program Files\Synaptics\SynTP\SynBtnAsst.exe [54568 2010-05-03] (Synaptics Incorporated)
HKLM\...\Run: [OnekeyStudio] => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [789920 2011-05-17] (Lenovo)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4448704 2010-03-11] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [7056832 2010-03-11] (Lenovo (Beijing) Limited)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [MuteSync] => C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe [336384 2009-12-28] (Lenovo)
HKLM-x32\...\Run: [Lenovo SplitScreen] => C:\Program Files\Lenovo\Lenovo SplitScreen\SplitScreen\AutoRunSpS.exe [778592 2010-06-23] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] => c:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => c:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2010-02-03] (CyberLink Corp.)
HKLM-x32\...\Run: [Lenovo SlideNav2] => C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlideNavVDM.exe [318400 2009-12-30] (Lenovo)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [74752 2011-10-26] (Nullsoft, Inc.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443408 2013-09-09] (Research In Motion Limited)
HKLM-x32\...\Run: [RIM PeerManager] => C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [4424704 2013-11-05] (Research In Motion Limited)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [703888 2013-06-19] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2014-10-14] (Microsoft Corporation)
HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1942720 2015-01-23] (Valve Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\REALTEK 11n USB Wireless LAN Utility.lnk
ShortcutTarget: REALTEK 11n USB Wireless LAN Utility.lnk -> C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
Startup: C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe (No File)
Startup: C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-884760279-2294033944-2841522718-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-884760279-2294033944-2841522718-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-884760279-2294033944-2841522718-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPBDE042E6-0BAD-4323-A6C5-2B2CAAB01454&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-884760279-2294033944-2841522718-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKU\S-1-5-21-884760279-2294033944-2841522718-1000 -> {94bd6970-1a83-41dc-9be5-bf50b3d0238f} URL = 
BHO: avast! Online Security -> {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll No File
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll No File
Toolbar: HKLM-x32 - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files (x86)\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH)
DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\3kpso6nv.default-1387541310027
FF DefaultSearchEngine: Google
FF Homepage: www.google.de
FF Keyword.URL: 
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 -> C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\TV\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @zylom.com/ZylomGamesPlayer -> C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: NoScript - C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\3kpso6nv.default-1387541310027\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-02-08]
FF Extension: Adblock Plus - C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\3kpso6nv.default-1387541310027\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-08]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012-01-09]
FF HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-03-03]
FF HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Internet\Firefox\firefox.exe

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R3 BlackBerry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2013-09-09] (Research In Motion Limited) [File not signed]
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [873248 2010-01-12] (Broadcom Corporation.)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
S3 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-15] (Lenovo Group Limited)
S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [509192 2009-08-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [575304 2009-11-17] (Lenovo Group Limited)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)
S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-15] (Lenovo Group Limited)
R2 RIM MDNS; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [389632 2013-11-05] (Apple Inc.) [File not signed]
R2 RIM Tunnel Service; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [1286656 2013-11-05] (Research In Motion Limited) [File not signed]
R2 Slidebar Notifier Service; C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNotifier.exe [69568 2009-12-30] (Lenovo)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 acedrv07; C:\windows\system32\drivers\acedrv07.sys [125440 2013-01-13] () [File not signed]
R1 acedrv09; C:\windows\system32\drivers\acedrv09.sys [134880 2014-06-06] ()
S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [368832 2009-11-05] (AfaTech                  )
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)
S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)
S3 ezplay; C:\Windows\System32\Drivers\ezplay.sys [118400 2011-10-06] (VSO Software)
R1 HWiNFO32; C:\windows\system32\drivers\HWiNFO64A.SYS [26528 2015-01-16] (REALiX(tm))
R3 JmUsbCcgp; C:\Windows\System32\DRIVERS\jmccgp.sys [17904 2010-02-05] (JMicron Technology Corp.)
R3 JmUsbVideo; C:\Windows\System32\Drivers\jmcam.sys [56688 2010-02-05] (JMicron Technology Corp.)
R3 JmUsbVideo2; C:\Windows\System32\Drivers\jmcam_lo.sys [31088 2010-02-05] (JMicron Technology Corp.)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [79872 2013-06-27] (Research In Motion Limited)
R3 rimvndis; C:\Windows\System32\Drivers\rimvndis6_AMD64.sys [17920 2013-11-05] (Research in Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [113704 2008-10-21] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [19496 2008-10-21] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [152616 2008-10-21] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [133160 2008-10-21] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [34856 2008-10-21] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [128552 2008-10-21] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [145960 2008-10-21] (MCCI Corporation)
S3 usbrndis6; C:\Windows\system32\drivers\usb80236.sys [19968 2013-02-12] (Microsoft Corporation)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-06-19] (Cisco Systems, Inc.)
R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)
U3 BcmSqlStartupSvc; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U2 IviRegMgr; No ImagePath
U2 RichVideo; No ImagePath
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
U3 SQLWriter; No ImagePath
S3 zlportio; \??\C:\Program Files (x86)\UltraStar\zlportio.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-14 09:31 - 2015-02-14 09:31 - 00000628 _____ () C:\Users\Jeanette\Desktop\JRT.txt
2015-02-14 09:21 - 2015-02-14 09:21 - 00002861 _____ () C:\Users\Jeanette\Desktop\AdwCleaner[S0].txt
2015-02-14 09:08 - 2015-02-14 09:17 - 00000000 ____D () C:\AdwCleaner
2015-02-14 09:07 - 2015-02-14 09:07 - 02112512 _____ () C:\Users\Jeanette\Downloads\AdwCleaner_4.110.exe
2015-02-14 09:07 - 2015-02-14 09:07 - 01388274 _____ (Thisisu) C:\Users\Jeanette\Desktop\JRT.exe
2015-02-13 10:32 - 2015-02-13 10:32 - 00272216 _____ () C:\windows\Minidump\021315-39795-01.dmp
2015-02-12 08:34 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-02-12 08:34 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-02-12 08:34 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-02-12 08:34 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-02-12 08:19 - 2015-02-12 08:19 - 00458624 _____ () C:\windows\Minidump\021215-62103-01.dmp
2015-02-11 17:58 - 2015-02-11 17:58 - 00090334 _____ () C:\Users\Jeanette\Desktop\gmer.txt
2015-02-11 09:55 - 2015-02-11 09:57 - 00043857 _____ () C:\Users\Jeanette\Desktop\Addition.txt
2015-02-11 09:53 - 2015-02-14 09:32 - 00025659 _____ () C:\Users\Jeanette\Desktop\FRST.txt
2015-02-11 09:51 - 2015-02-11 09:52 - 00000000 ____D () C:\Users\Jeanette\Desktop\crash
2015-02-11 09:51 - 2015-02-11 09:51 - 00048480 _____ () C:\Users\Jeanette\Desktop\bluescreens.txt
2015-02-11 09:50 - 2015-02-11 09:50 - 00067310 _____ () C:\Users\Jeanette\Downloads\bluescreenview_v1.55.zip
2015-02-11 09:50 - 2015-02-11 09:50 - 00000000 ____D () C:\Users\Jeanette\Downloads\bluescreenview_v1.55
2015-02-11 09:23 - 2015-02-11 09:23 - 00000478 _____ () C:\Users\Jeanette\Desktop\defogger_disable.log
2015-02-11 09:23 - 2015-02-11 09:23 - 00000000 _____ () C:\Users\Jeanette\defogger_reenable
2015-02-11 09:08 - 2015-02-11 09:08 - 00270952 _____ () C:\windows\Minidump\021115-101260-01.dmp
2015-02-11 08:31 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\windows\system32\perftrack.dll
2015-02-11 08:31 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\wdi.dll
2015-02-11 08:31 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\windows\system32\powertracker.dll
2015-02-11 08:31 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdi.dll
2015-02-11 08:05 - 2015-02-11 08:06 - 00270888 _____ () C:\windows\Minidump\021115-61869-01.dmp
2015-02-10 22:25 - 2015-02-10 22:25 - 00000000 ____D () C:\d0cb5eb160bce8c232
2015-02-10 22:03 - 2015-02-10 22:03 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Avira
2015-02-10 21:49 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-02-10 21:49 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-02-10 21:49 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe
2015-02-10 21:49 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-02-10 21:49 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-02-10 21:49 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-02-10 21:49 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-02-10 21:49 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-02-10 21:49 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-02-10 21:49 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-02-10 21:49 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-02-10 21:49 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-02-10 21:49 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-02-10 21:49 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-02-10 21:49 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-10 21:49 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-02-10 21:49 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-02-10 21:49 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-02-10 21:49 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-02-10 21:48 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-02-10 21:48 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-02-10 21:48 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-02-10 21:48 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-02-10 21:48 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-02-10 21:48 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-02-10 21:48 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-02-10 21:48 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-02-10 21:48 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-02-10 21:48 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-02-10 21:48 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-02-10 21:48 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-02-10 21:48 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-02-10 21:48 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-02-10 21:48 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-02-10 21:48 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-02-10 21:48 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-02-10 21:48 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-02-10 21:48 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-02-10 21:48 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-02-10 21:48 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-02-10 21:48 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-02-10 21:48 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-02-10 21:48 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-02-10 21:48 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-02-10 21:48 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-02-10 21:48 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-02-10 21:48 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-02-10 21:48 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-02-10 21:48 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-02-10 21:48 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-02-10 21:48 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-02-10 21:48 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-02-10 21:48 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-02-10 21:48 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-02-10 21:48 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-02-10 21:47 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-02-10 21:47 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-02-10 21:47 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-02-10 21:47 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-02-10 21:47 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-02-10 21:47 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-02-10 21:47 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-02-10 21:47 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-02-10 21:47 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-02-10 21:47 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-02-10 21:47 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-02-10 21:47 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-02-10 21:47 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-02-10 21:47 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-02-10 21:47 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-02-10 21:47 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-02-10 21:47 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-02-10 21:47 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-02-10 21:47 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-02-10 21:47 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-02-10 21:46 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-02-10 21:46 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2015-02-10 21:46 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2015-02-10 21:46 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2015-02-10 21:46 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2015-02-10 21:46 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2015-02-10 21:45 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-02-10 21:45 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-02-10 21:45 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-02-10 21:45 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-02-10 21:45 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-02-10 21:45 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-02-10 21:45 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-02-10 21:45 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2015-02-10 21:45 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2015-02-10 21:43 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
2015-02-10 21:43 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\windows\SysWOW64\scesrv.dll
2015-02-10 21:40 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-02-10 21:21 - 2015-02-10 21:16 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2015-02-10 21:14 - 2014-11-24 10:23 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2015-02-10 21:14 - 2014-11-24 10:23 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2015-02-10 21:14 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2015-02-10 20:54 - 2015-02-10 20:54 - 00000000 ____D () C:\OETemp
2015-02-10 20:37 - 2015-01-24 13:09 - 00272296 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2015-02-10 20:36 - 2015-01-24 13:09 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2015-02-10 20:36 - 2015-01-24 13:09 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2015-02-10 20:36 - 2015-01-24 13:09 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-10 20:17 - 2015-02-10 20:17 - 00278144 _____ () C:\windows\Minidump\021015-46925-01.dmp
2015-02-09 21:34 - 2015-02-10 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-09 21:34 - 2015-02-10 21:14 - 00000000 ____D () C:\ProgramData\Avira
2015-02-09 21:34 - 2015-02-10 21:14 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-09 21:34 - 2015-02-09 21:34 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2015-02-09 21:34 - 2015-02-09 21:34 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-09 21:00 - 2015-02-09 21:00 - 00272216 _____ () C:\windows\Minidump\020915-33306-01.dmp
2015-02-09 20:23 - 2015-02-09 20:23 - 00380416 _____ () C:\Users\Jeanette\Desktop\Gmer-19357(1).exe
2015-02-09 20:15 - 2015-02-14 09:32 - 00000000 ____D () C:\FRST
2015-02-09 20:14 - 2015-02-09 20:14 - 02132992 _____ (Farbar) C:\Users\Jeanette\Desktop\FRST64.exe
2015-02-09 20:14 - 2015-02-09 20:14 - 00050477 _____ () C:\Users\Jeanette\Desktop\Defogger.exe
2015-02-09 19:15 - 2015-02-10 18:47 - 00001215 _____ () C:\Users\Jeanette\Desktop\Malewarebytes.txt
2015-02-09 14:50 - 2015-02-09 14:50 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Jeanette\Downloads\avira_de_av_5839340206__ws.exe
2015-02-08 18:08 - 2015-02-10 22:06 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster
2015-02-08 18:08 - 2015-02-08 18:08 - 00448512 _____ (OldTimer Tools) C:\Users\Jeanette\Downloads\TFC.exe
2015-02-08 18:08 - 2015-02-08 18:08 - 00001079 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk
2015-02-08 18:08 - 2015-02-08 18:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2015-02-08 18:08 - 2009-03-24 12:52 - 00129872 _____ (Microsoft Corporation) C:\windows\SysWOW64\MSSTDFMT.DLL
2015-02-08 17:58 - 2015-02-08 18:09 - 42096984 _____ (Apple Inc.) C:\Users\Jeanette\Downloads\QuickTimeInstaller.exe
2015-02-08 17:54 - 2015-02-10 20:37 - 00001484 _____ () C:\windows\SecuniaPackage.log
2015-02-08 10:49 - 2015-02-08 10:54 - 465199132 _____ () C:\Users\Jeanette\Downloads\Die Analphabetin, die rechnen konnte.wma
2015-02-08 10:35 - 2015-02-08 10:35 - 04095448 _____ (BrightFort LLC ) C:\Users\Jeanette\Downloads\spywareblastersetup50.exe
2015-02-08 10:34 - 2015-02-08 10:38 - 372014989 _____ () C:\Users\Jeanette\Downloads\Süßer Tod.wma
2015-02-08 10:31 - 2015-02-08 10:31 - 00543951 _____ () C:\Users\Jeanette\Downloads\noscript-2.6.9.12.xpi.zip
2015-02-08 10:24 - 2015-02-08 10:24 - 05490752 _____ (Secunia) C:\Users\Jeanette\Downloads\PSISetup10004.exe
2015-02-07 22:00 - 2015-02-07 22:23 - 129967104 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_05.wma
2015-02-07 21:37 - 2015-02-07 22:01 - 125126544 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_04.wma
2015-02-07 21:10 - 2015-02-07 22:01 - 127152408 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_03.wma
2015-02-07 20:38 - 2015-02-07 21:43 - 124427352 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_02.wma
2015-02-07 19:37 - 2015-02-07 20:38 - 405903016 _____ () C:\Users\Jeanette\Downloads\Smaragdgrün - Liebe geht durch alle Zeiten(1).wma
2015-02-07 19:23 - 2015-02-07 21:23 - 130253952 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_01.wma
2015-02-07 16:18 - 2015-02-07 16:26 - 81307064 _____ (Swiss Academic Software) C:\Users\Jeanette\Downloads\Citavi4Setup(1).exe
2015-02-02 17:10 - 2015-02-02 17:12 - 00278144 _____ () C:\windows\Minidump\020215-34242-01.dmp
2015-01-31 10:54 - 2015-01-31 10:54 - 00004901 _____ () C:\Users\Jeanette\Downloads\sf535adWBhQ&fs=1&rel=0&autoplay=1
2015-01-29 18:03 - 2015-01-29 18:37 - 00014302 _____ () C:\Users\Jeanette\Documents\Sicherungskopie von Kassenbericht 2014.wbk
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 __SHD () C:\Users\Jeanette\AppData\Local\EmieUserList
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 __SHD () C:\Users\Jeanette\AppData\Local\EmieSiteList
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 __SHD () C:\Users\Jeanette\AppData\Local\EmieBrowserModeList
2015-01-24 13:07 - 2015-01-24 13:07 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\pcwJavaUpdate
2015-01-24 13:06 - 2015-01-24 13:06 - 00017787 _____ () C:\Users\Jeanette\Downloads\pcwJavaUpdater_103.zip
2015-01-21 15:40 - 2015-02-13 11:32 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-21 15:39 - 2015-01-21 15:39 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-21 15:39 - 2015-01-21 15:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-21 15:39 - 2015-01-21 15:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-21 15:39 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-01-21 15:39 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-01-21 15:39 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-01-21 15:35 - 2015-01-21 15:35 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Jeanette\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-20 16:47 - 2015-01-24 13:35 - 00000000 ____D () C:\windows\erdnt
2015-01-20 16:33 - 2015-01-24 13:41 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-20 16:32 - 2015-01-20 16:32 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jeanette\Downloads\revosetup95.exe
2015-01-16 17:38 - 2015-01-16 17:41 - 00000000 ____D () C:\Program Files\HWiNFO64
2015-01-16 17:38 - 2015-01-16 17:38 - 00026528 _____ (REALiX(tm)) C:\windows\system32\Drivers\HWiNFO64A.SYS
2015-01-16 17:38 - 2015-01-16 17:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HWiNFO64
2015-01-16 17:37 - 2015-01-16 17:37 - 02699320 _____ (Martin Malík - REALiX ) C:\Users\Jeanette\Downloads\hw64_448.exe
2015-01-16 12:15 - 2015-01-16 12:15 - 00380416 _____ () C:\Users\Jeanette\Downloads\Gmer-19357.exe
2015-01-16 11:52 - 2015-01-16 11:52 - 01353682 _____ () C:\Users\Jeanette\Downloads\hwmonitor_1.26.zip
2015-01-16 11:52 - 2015-01-16 11:52 - 00000000 ____D () C:\Users\Jeanette\Downloads\hwmonitor_1.26
2015-01-16 11:51 - 2015-01-16 18:04 - 00000000 ____D () C:\Users\Jeanette\Downloads\hwmonitor_1.24
2015-01-16 11:51 - 2015-01-16 11:51 - 01211573 _____ () C:\Users\Jeanette\Downloads\hwmonitor_1.24.zip
2015-01-16 11:44 - 2015-01-16 11:44 - 00141480 _____ () C:\Users\Jeanette\Downloads\bluescreenview_152setup.exe
2015-01-16 11:44 - 2015-01-16 11:44 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2015-01-16 11:44 - 2015-01-16 11:44 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2015-01-16 11:31 - 2015-01-16 11:31 - 00278144 _____ () C:\windows\Minidump\011615-38547-01.dmp
2015-01-16 06:42 - 2015-01-16 06:42 - 00278144 _____ () C:\windows\Minidump\011615-37627-01.dmp
2015-01-15 21:08 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-15 20:55 - 2015-01-15 20:56 - 00278144 _____ () C:\windows\Minidump\011515-118217-01.dmp
2015-01-15 19:32 - 2015-01-15 19:32 - 00278144 _____ () C:\windows\Minidump\011515-36270-01.dmp
2015-01-15 18:56 - 2015-01-15 18:59 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Jeanette\Downloads\mbam-setup-majorgeeks-2.0.4.1028.exe
2015-01-15 18:51 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-15 18:51 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-15 18:51 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-15 18:51 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll
2015-01-15 18:51 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-14 09:28 - 2009-07-14 05:45 - 00019296 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-14 09:28 - 2009-07-14 05:45 - 00019296 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-14 09:22 - 2013-12-09 16:03 - 00000000 ___RD () C:\Users\Jeanette\Dropbox
2015-02-14 09:21 - 2013-12-09 15:59 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Dropbox
2015-02-14 09:20 - 2014-12-29 11:51 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-02-14 09:20 - 2012-04-01 12:03 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-14 09:18 - 2013-12-07 17:32 - 00038353 _____ () C:\windows\setupact.log
2015-02-14 09:18 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-14 09:17 - 2011-05-17 16:16 - 01584446 _____ () C:\windows\WindowsUpdate.log
2015-02-14 08:56 - 2013-11-27 19:23 - 00000000 ____D () C:\Users\Jeanette\Documents\Citavi 4
2015-02-14 08:51 - 2012-04-01 12:03 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-13 11:04 - 2011-06-12 21:33 - 00000000 ____D () C:\Users\Jeanette\vista alt
2015-02-13 10:42 - 2013-12-08 18:55 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-13 10:32 - 2014-02-27 18:24 - 418907904 _____ () C:\windows\MEMORY.DMP
2015-02-13 10:32 - 2011-09-18 14:01 - 00000000 ____D () C:\windows\Minidump
2015-02-12 21:37 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\rescache
2015-02-12 19:05 - 2012-07-07 08:41 - 01594964 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2015-02-12 19:05 - 2011-05-17 23:46 - 00699682 _____ () C:\windows\system32\perfh007.dat
2015-02-12 19:05 - 2011-05-17 23:46 - 00149790 _____ () C:\windows\system32\perfc007.dat
2015-02-12 19:05 - 2009-07-14 06:13 - 01594964 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-12 09:45 - 2011-11-27 14:43 - 00000000 ____D () C:\Users\Jeanette\Documents\Outlook-Dateien
2015-02-11 09:23 - 2011-06-05 09:16 - 00000000 ____D () C:\Users\Jeanette
2015-02-11 09:07 - 2013-12-08 15:22 - 01070476 _____ () C:\windows\PFRO.log
2015-02-11 08:56 - 2014-12-11 14:06 - 00000000 ____D () C:\windows\system32\appraiser
2015-02-11 08:56 - 2014-07-09 16:41 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-02-11 08:56 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\tracing
2015-02-11 08:54 - 2011-08-19 10:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-11 08:54 - 2009-07-14 03:34 - 00000478 _____ () C:\windows\win.ini
2015-02-11 08:11 - 2013-12-09 16:00 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-02-11 08:05 - 2009-07-14 05:45 - 00459784 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-10 22:24 - 2013-07-16 21:55 - 00000000 ____D () C:\windows\system32\MRT
2015-02-10 22:13 - 2011-06-08 20:03 - 116773704 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-02-10 22:06 - 2011-05-17 16:43 - 00000000 ____D () C:\ProgramData\Temp
2015-02-10 20:43 - 2013-12-20 13:12 - 00007603 _____ () C:\Users\Jeanette\AppData\Local\Resmon.ResmonCfg
2015-02-10 20:36 - 2011-06-06 11:20 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-08 18:09 - 2012-09-28 11:28 - 00000000 ____D () C:\ProgramData\Licenses
2015-02-07 16:57 - 2014-11-26 15:59 - 00001949 _____ () C:\Users\Public\Desktop\Citavi 4.lnk
2015-02-07 16:57 - 2013-11-27 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citavi 4
2015-02-07 16:57 - 2012-01-09 19:12 - 00000000 ____D () C:\ProgramData\Swiss Academic Software
2015-02-07 16:51 - 2011-09-10 11:23 - 00000000 ____D () C:\Users\Jeanette\AppData\Local\Downloaded Installations
2015-02-07 15:46 - 2012-04-01 12:03 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 15:46 - 2012-04-01 12:03 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-04 08:06 - 2009-07-14 06:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2015-02-04 08:05 - 2011-12-13 12:33 - 00001421 _____ () C:\Users\Finja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-28 17:12 - 2012-08-28 09:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 20:26 - 2011-06-06 09:53 - 00000000 ____D () C:\Program Files (x86)\Internet
2015-01-24 13:40 - 2013-12-14 13:02 - 00001616 _____ () C:\DelFix.txt
2015-01-24 13:09 - 2013-11-12 14:35 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-24 13:09 - 2013-11-12 14:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-20 17:24 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-01-20 17:13 - 2009-07-14 03:34 - 00000215 _____ () C:\windows\system.ini
2015-01-20 17:11 - 2009-07-14 03:34 - 97255424 _____ () C:\windows\system32\config\software.bak
2015-01-20 17:11 - 2009-07-14 03:34 - 24641536 _____ () C:\windows\system32\config\system.bak
2015-01-20 17:11 - 2009-07-14 03:34 - 00524288 _____ () C:\windows\system32\config\default.bak
2015-01-20 17:11 - 2009-07-14 03:34 - 00262144 _____ () C:\windows\system32\config\security.bak
2015-01-20 17:11 - 2009-07-14 03:34 - 00262144 _____ () C:\windows\system32\config\sam.bak
2015-01-20 17:08 - 2011-06-05 20:42 - 00000000 ____D () C:\Users\Christoph
2015-01-20 16:40 - 2011-10-30 19:23 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Winamp
2015-01-16 11:40 - 2011-06-15 09:44 - 00000000 ____D () C:\Users\Jeanette\Documents\Nähen
2015-01-16 11:34 - 2013-08-30 10:12 - 00000000 ____D () C:\Users\Public\Documents\PearlMountain
2015-01-16 11:34 - 2013-06-01 20:05 - 00000000 ____D () C:\Users\Jeanette\Documents\PassionFruit Games
2015-01-16 11:34 - 2011-08-22 09:22 - 00000000 ____D () C:\Users\Public\Documents\Kontoauszüge

==================== Files in the root of some directories =======

2013-12-18 14:28 - 2013-12-18 14:45 - 50063360 _____ () C:\Program Files (x86)\GUTD662.tmp
2011-10-06 08:42 - 2012-02-12 20:33 - 0007833 _____ () C:\Users\Jeanette\AppData\Roaming\ezplay.cat
2011-10-06 08:42 - 2012-02-12 20:33 - 0001127 _____ () C:\Users\Jeanette\AppData\Roaming\ezplay.inf
2011-10-06 08:42 - 2011-10-06 08:42 - 0000125 _____ () C:\Users\Jeanette\AppData\Roaming\ezplay.ini
2011-10-06 08:43 - 2012-02-12 20:33 - 0000033 _____ () C:\Users\Jeanette\AppData\Roaming\ezplay.log
2011-10-06 08:42 - 2012-02-12 20:33 - 0118400 _____ (VSO Software) C:\Users\Jeanette\AppData\Roaming\ezplay.sys
2011-10-06 08:42 - 2012-02-12 20:33 - 0099384 _____ () C:\Users\Jeanette\AppData\Roaming\inst.exe
2012-11-15 14:15 - 2012-11-15 14:15 - 0021887 _____ () C:\Users\Jeanette\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2012-01-02 15:47 - 2012-01-02 15:47 - 0004096 ____H () C:\Users\Jeanette\AppData\Local\keyfile3.drm
2013-11-08 14:22 - 2013-11-08 14:22 - 0005506 _____ () C:\Users\Jeanette\AppData\Local\recently-used.xbel
2013-12-20 13:12 - 2015-02-10 20:43 - 0007603 _____ () C:\Users\Jeanette\AppData\Local\Resmon.ResmonCfg
2011-10-05 14:26 - 2012-04-17 11:47 - 0000040 ___SH () C:\ProgramData\.zreglib
2011-06-05 13:29 - 2011-06-05 13:29 - 0000088 _____ () C:\ProgramData\profile.xml

Some content of TEMP:
====================
C:\Users\Christoph\AppData\Local\Temp\avgnt.exe
C:\Users\Finja\AppData\Local\Temp\avgnt.exe
C:\Users\Jeanette\AppData\Local\Temp\avgnt.exe
C:\Users\Jeanette\AppData\Local\Temp\DRHelper_uninstallComplete.exe
C:\Users\Jeanette\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpkq5plv.dll
C:\Users\Jeanette\AppData\Local\Temp\Quarantine.exe
C:\Users\Jeanette\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-13 12:39

==================== End Of Log ============================
         

--- --- ---


Gruß ennachen

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Guten Morgen,

eset:

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=c13dabc49b351f49a33e27330be76633
# engine=22476
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-15 04:01:33
# local_time=2015-02-15 05:01:33 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 99 54669 7155493 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 373457 175602743 0 0
# scanned=384039
# found=0
# cleaned=0
# scan_time=28995
         

SecurityCheck:

 Results of screen317's Security Check version 0.99.96  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 SpywareBlaster 5.0    
 Java 7 Update 75  
 Java 8 Update 31  
 Java version 32-bit out of Date! 
  Java 64-bit 8 Update 31  
 Adobe Reader XI  
 Mozilla Firefox (35.0.1) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

Frst:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-02-2015
Ran by Jeanette (administrator) on KASSIOPEIA on 15-02-2015 08:50:23
Running from C:\Users\Jeanette\Desktop
Loaded Profiles: Jeanette (Available profiles: Jeanette & Christoph & Finja)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\mDNSResponder.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNotifier.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynBtnAsst.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
() C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
(Dropbox, Inc.) C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlideNavVDM.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNavigator.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\tunmgr.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\BbDevMgr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Internet\Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11725928 2010-12-23] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2010-12-10] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2101032 2010-05-03] (Synaptics Incorporated)
HKLM\...\Run: [SynBtnAsst] => C:\Program Files\Synaptics\SynTP\SynBtnAsst.exe [54568 2010-05-03] (Synaptics Incorporated)
HKLM\...\Run: [OnekeyStudio] => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [789920 2011-05-17] (Lenovo)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4448704 2010-03-11] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [7056832 2010-03-11] (Lenovo (Beijing) Limited)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [MuteSync] => C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe [336384 2009-12-28] (Lenovo)
HKLM-x32\...\Run: [Lenovo SplitScreen] => C:\Program Files\Lenovo\Lenovo SplitScreen\SplitScreen\AutoRunSpS.exe [778592 2010-06-23] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] => c:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => c:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2010-02-03] (CyberLink Corp.)
HKLM-x32\...\Run: [Lenovo SlideNav2] => C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlideNavVDM.exe [318400 2009-12-30] (Lenovo)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [74752 2011-10-26] (Nullsoft, Inc.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443408 2013-09-09] (Research In Motion Limited)
HKLM-x32\...\Run: [RIM PeerManager] => C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [4424704 2013-11-05] (Research In Motion Limited)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [703888 2013-06-19] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2014-10-14] (Microsoft Corporation)
HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1942720 2015-01-23] (Valve Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\REALTEK 11n USB Wireless LAN Utility.lnk
ShortcutTarget: REALTEK 11n USB Wireless LAN Utility.lnk -> C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
Startup: C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe (No File)
Startup: C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jeanette\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-884760279-2294033944-2841522718-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-884760279-2294033944-2841522718-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-884760279-2294033944-2841522718-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPBDE042E6-0BAD-4323-A6C5-2B2CAAB01454&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-884760279-2294033944-2841522718-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKU\S-1-5-21-884760279-2294033944-2841522718-1000 -> {94bd6970-1a83-41dc-9be5-bf50b3d0238f} URL = 
BHO: avast! Online Security -> {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll No File
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll No File
Toolbar: HKLM-x32 - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files (x86)\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH)
DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\3kpso6nv.default-1387541310027
FF DefaultSearchEngine: Google
FF Homepage: www.google.de
FF Keyword.URL: 
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 -> C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\TV\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @zylom.com/ZylomGamesPlayer -> C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: NoScript - C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\3kpso6nv.default-1387541310027\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-02-08]
FF Extension: Adblock Plus - C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\3kpso6nv.default-1387541310027\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-08]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012-01-09]
FF HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-03-03]
FF HKU\S-1-5-21-884760279-2294033944-2841522718-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Internet\Firefox\firefox.exe

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R3 BlackBerry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2013-09-09] (Research In Motion Limited) [File not signed]
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [873248 2010-01-12] (Broadcom Corporation.)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
S3 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-15] (Lenovo Group Limited)
S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [509192 2009-08-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [575304 2009-11-17] (Lenovo Group Limited)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)
S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-15] (Lenovo Group Limited)
R2 RIM MDNS; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [389632 2013-11-05] (Apple Inc.) [File not signed]
R2 RIM Tunnel Service; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [1286656 2013-11-05] (Research In Motion Limited) [File not signed]
R2 Slidebar Notifier Service; C:\Program Files\Lenovo\Lenovo SlideNav\SlidebarNavigator\SlidebarNotifier.exe [69568 2009-12-30] (Lenovo)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 acedrv07; C:\windows\system32\drivers\acedrv07.sys [125440 2013-01-13] () [File not signed]
R1 acedrv09; C:\windows\system32\drivers\acedrv09.sys [134880 2014-06-06] ()
S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [368832 2009-11-05] (AfaTech                  )
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)
S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)
S3 ezplay; C:\Windows\System32\Drivers\ezplay.sys [118400 2011-10-06] (VSO Software)
R1 HWiNFO32; C:\windows\system32\drivers\HWiNFO64A.SYS [26528 2015-01-16] (REALiX(tm))
R3 JmUsbCcgp; C:\Windows\System32\DRIVERS\jmccgp.sys [17904 2010-02-05] (JMicron Technology Corp.)
R3 JmUsbVideo; C:\Windows\System32\Drivers\jmcam.sys [56688 2010-02-05] (JMicron Technology Corp.)
R3 JmUsbVideo2; C:\Windows\System32\Drivers\jmcam_lo.sys [31088 2010-02-05] (JMicron Technology Corp.)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [79872 2013-06-27] (Research In Motion Limited)
R3 rimvndis; C:\Windows\System32\Drivers\rimvndis6_AMD64.sys [17920 2013-11-05] (Research in Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [113704 2008-10-21] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [19496 2008-10-21] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [152616 2008-10-21] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [133160 2008-10-21] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [34856 2008-10-21] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [128552 2008-10-21] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [145960 2008-10-21] (MCCI Corporation)
S3 usbrndis6; C:\Windows\system32\drivers\usb80236.sys [19968 2013-02-12] (Microsoft Corporation)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-06-19] (Cisco Systems, Inc.)
R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)
U3 BcmSqlStartupSvc; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U2 IviRegMgr; No ImagePath
U2 RichVideo; No ImagePath
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
U3 SQLWriter; No ImagePath
S3 zlportio; \??\C:\Program Files (x86)\UltraStar\zlportio.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-15 08:50 - 2015-02-15 08:50 - 00000000 ____D () C:\Users\Jeanette\Desktop\FRST-OlderVersion
2015-02-15 08:49 - 2015-02-15 08:49 - 00000854 _____ () C:\Users\Jeanette\Desktop\checkup.txt
2015-02-15 08:37 - 2015-02-15 08:37 - 00000790 _____ () C:\Users\Jeanette\Desktop\eset.txt
2015-02-14 20:51 - 2015-02-14 20:51 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-02-14 20:49 - 2015-02-14 20:49 - 00852594 _____ () C:\Users\Jeanette\Desktop\SecurityCheck.exe
2015-02-14 20:44 - 2015-02-14 20:45 - 02347384 _____ (ESET) C:\Users\Jeanette\Desktop\esetsmartinstaller_deu.exe
2015-02-14 09:31 - 2015-02-14 09:31 - 00000628 _____ () C:\Users\Jeanette\Desktop\JRT.txt
2015-02-14 09:21 - 2015-02-14 09:21 - 00002861 _____ () C:\Users\Jeanette\Desktop\AdwCleaner[S0].txt
2015-02-14 09:08 - 2015-02-14 09:17 - 00000000 ____D () C:\AdwCleaner
2015-02-14 09:07 - 2015-02-14 09:07 - 02112512 _____ () C:\Users\Jeanette\Downloads\AdwCleaner_4.110.exe
2015-02-14 09:07 - 2015-02-14 09:07 - 01388274 _____ (Thisisu) C:\Users\Jeanette\Desktop\JRT.exe
2015-02-13 10:32 - 2015-02-13 10:32 - 00272216 _____ () C:\windows\Minidump\021315-39795-01.dmp
2015-02-12 08:34 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-02-12 08:34 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-02-12 08:34 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-02-12 08:34 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-02-12 08:19 - 2015-02-12 08:19 - 00458624 _____ () C:\windows\Minidump\021215-62103-01.dmp
2015-02-11 17:58 - 2015-02-11 17:58 - 00090334 _____ () C:\Users\Jeanette\Desktop\gmer.txt
2015-02-11 09:55 - 2015-02-11 09:57 - 00043857 _____ () C:\Users\Jeanette\Desktop\Addition.txt
2015-02-11 09:53 - 2015-02-15 08:50 - 00025880 _____ () C:\Users\Jeanette\Desktop\FRST.txt
2015-02-11 09:51 - 2015-02-11 09:52 - 00000000 ____D () C:\Users\Jeanette\Desktop\crash
2015-02-11 09:51 - 2015-02-11 09:51 - 00048480 _____ () C:\Users\Jeanette\Desktop\bluescreens.txt
2015-02-11 09:50 - 2015-02-11 09:50 - 00067310 _____ () C:\Users\Jeanette\Downloads\bluescreenview_v1.55.zip
2015-02-11 09:50 - 2015-02-11 09:50 - 00000000 ____D () C:\Users\Jeanette\Downloads\bluescreenview_v1.55
2015-02-11 09:23 - 2015-02-11 09:23 - 00000478 _____ () C:\Users\Jeanette\Desktop\defogger_disable.log
2015-02-11 09:23 - 2015-02-11 09:23 - 00000000 _____ () C:\Users\Jeanette\defogger_reenable
2015-02-11 09:08 - 2015-02-11 09:08 - 00270952 _____ () C:\windows\Minidump\021115-101260-01.dmp
2015-02-11 08:31 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\windows\system32\perftrack.dll
2015-02-11 08:31 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\wdi.dll
2015-02-11 08:31 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\windows\system32\powertracker.dll
2015-02-11 08:31 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdi.dll
2015-02-11 08:05 - 2015-02-11 08:06 - 00270888 _____ () C:\windows\Minidump\021115-61869-01.dmp
2015-02-10 22:25 - 2015-02-10 22:25 - 00000000 ____D () C:\d0cb5eb160bce8c232
2015-02-10 22:03 - 2015-02-10 22:03 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Avira
2015-02-10 21:49 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-02-10 21:49 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-02-10 21:49 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-02-10 21:49 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe
2015-02-10 21:49 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-02-10 21:49 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-02-10 21:49 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-02-10 21:49 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-02-10 21:49 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-02-10 21:49 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-02-10 21:49 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-02-10 21:49 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-02-10 21:49 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-02-10 21:49 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-02-10 21:49 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-02-10 21:49 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-10 21:49 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-02-10 21:49 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-02-10 21:49 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-02-10 21:49 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-02-10 21:49 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-02-10 21:49 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-02-10 21:48 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-02-10 21:48 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-02-10 21:48 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-02-10 21:48 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-02-10 21:48 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-02-10 21:48 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-02-10 21:48 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-02-10 21:48 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-02-10 21:48 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-02-10 21:48 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-02-10 21:48 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-02-10 21:48 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-02-10 21:48 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-02-10 21:48 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-02-10 21:48 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-02-10 21:48 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-02-10 21:48 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-02-10 21:48 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-02-10 21:48 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-02-10 21:48 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-02-10 21:48 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-02-10 21:48 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-02-10 21:48 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-02-10 21:48 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-02-10 21:48 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-02-10 21:48 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-02-10 21:48 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-02-10 21:48 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-02-10 21:48 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-02-10 21:48 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-02-10 21:48 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-02-10 21:48 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-02-10 21:48 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-02-10 21:48 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-02-10 21:48 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-02-10 21:48 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-02-10 21:47 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-02-10 21:47 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-02-10 21:47 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-02-10 21:47 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-02-10 21:47 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-02-10 21:47 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-02-10 21:47 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-02-10 21:47 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-02-10 21:47 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-02-10 21:47 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-02-10 21:47 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-02-10 21:47 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-02-10 21:47 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-02-10 21:47 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-02-10 21:47 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-02-10 21:47 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-02-10 21:47 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-02-10 21:47 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-02-10 21:47 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-02-10 21:47 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-02-10 21:46 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-02-10 21:46 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2015-02-10 21:46 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2015-02-10 21:46 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2015-02-10 21:46 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2015-02-10 21:46 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2015-02-10 21:45 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-02-10 21:45 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-02-10 21:45 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-02-10 21:45 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-02-10 21:45 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-02-10 21:45 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-02-10 21:45 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-02-10 21:45 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2015-02-10 21:45 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2015-02-10 21:43 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
2015-02-10 21:43 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\windows\SysWOW64\scesrv.dll
2015-02-10 21:40 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-02-10 21:21 - 2015-02-10 21:16 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2015-02-10 21:14 - 2014-11-24 10:23 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2015-02-10 21:14 - 2014-11-24 10:23 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2015-02-10 21:14 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2015-02-10 20:54 - 2015-02-10 20:54 - 00000000 ____D () C:\OETemp
2015-02-10 20:37 - 2015-01-24 13:09 - 00272296 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2015-02-10 20:36 - 2015-01-24 13:09 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2015-02-10 20:36 - 2015-01-24 13:09 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2015-02-10 20:36 - 2015-01-24 13:09 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-10 20:17 - 2015-02-10 20:17 - 00278144 _____ () C:\windows\Minidump\021015-46925-01.dmp
2015-02-09 21:34 - 2015-02-10 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-09 21:34 - 2015-02-10 21:14 - 00000000 ____D () C:\ProgramData\Avira
2015-02-09 21:34 - 2015-02-10 21:14 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-09 21:34 - 2015-02-09 21:34 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2015-02-09 21:34 - 2015-02-09 21:34 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-09 21:00 - 2015-02-09 21:00 - 00272216 _____ () C:\windows\Minidump\020915-33306-01.dmp
2015-02-09 20:23 - 2015-02-09 20:23 - 00380416 _____ () C:\Users\Jeanette\Desktop\Gmer-19357(1).exe
2015-02-09 20:15 - 2015-02-15 08:50 - 00000000 ____D () C:\FRST
2015-02-09 20:14 - 2015-02-15 08:50 - 02134528 _____ (Farbar) C:\Users\Jeanette\Desktop\FRST64.exe
2015-02-09 20:14 - 2015-02-09 20:14 - 00050477 _____ () C:\Users\Jeanette\Desktop\Defogger.exe
2015-02-09 19:15 - 2015-02-10 18:47 - 00001215 _____ () C:\Users\Jeanette\Desktop\Malewarebytes.txt
2015-02-09 14:50 - 2015-02-09 14:50 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Jeanette\Downloads\avira_de_av_5839340206__ws.exe
2015-02-08 18:08 - 2015-02-10 22:06 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster
2015-02-08 18:08 - 2015-02-08 18:08 - 00448512 _____ (OldTimer Tools) C:\Users\Jeanette\Downloads\TFC.exe
2015-02-08 18:08 - 2015-02-08 18:08 - 00001079 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk
2015-02-08 18:08 - 2015-02-08 18:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2015-02-08 18:08 - 2009-03-24 12:52 - 00129872 _____ (Microsoft Corporation) C:\windows\SysWOW64\MSSTDFMT.DLL
2015-02-08 17:58 - 2015-02-08 18:09 - 42096984 _____ (Apple Inc.) C:\Users\Jeanette\Downloads\QuickTimeInstaller.exe
2015-02-08 17:54 - 2015-02-10 20:37 - 00001484 _____ () C:\windows\SecuniaPackage.log
2015-02-08 10:49 - 2015-02-08 10:54 - 465199132 _____ () C:\Users\Jeanette\Downloads\Die Analphabetin, die rechnen konnte.wma
2015-02-08 10:35 - 2015-02-08 10:35 - 04095448 _____ (BrightFort LLC ) C:\Users\Jeanette\Downloads\spywareblastersetup50.exe
2015-02-08 10:34 - 2015-02-08 10:38 - 372014989 _____ () C:\Users\Jeanette\Downloads\Süßer Tod.wma
2015-02-08 10:31 - 2015-02-08 10:31 - 00543951 _____ () C:\Users\Jeanette\Downloads\noscript-2.6.9.12.xpi.zip
2015-02-08 10:24 - 2015-02-08 10:24 - 05490752 _____ (Secunia) C:\Users\Jeanette\Downloads\PSISetup10004.exe
2015-02-07 22:00 - 2015-02-07 22:23 - 129967104 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_05.wma
2015-02-07 21:37 - 2015-02-07 22:01 - 125126544 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_04.wma
2015-02-07 21:10 - 2015-02-07 22:01 - 127152408 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_03.wma
2015-02-07 20:38 - 2015-02-07 21:43 - 124427352 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_02.wma
2015-02-07 19:37 - 2015-02-07 20:38 - 405903016 _____ () C:\Users\Jeanette\Downloads\Smaragdgrün - Liebe geht durch alle Zeiten(1).wma
2015-02-07 19:23 - 2015-02-07 21:23 - 130253952 _____ () C:\Users\Jeanette\Downloads\Die Eifel-Connection_01.wma
2015-02-07 16:18 - 2015-02-07 16:26 - 81307064 _____ (Swiss Academic Software) C:\Users\Jeanette\Downloads\Citavi4Setup(1).exe
2015-02-02 17:10 - 2015-02-02 17:12 - 00278144 _____ () C:\windows\Minidump\020215-34242-01.dmp
2015-01-31 10:54 - 2015-01-31 10:54 - 00004901 _____ () C:\Users\Jeanette\Downloads\sf535adWBhQ&fs=1&rel=0&autoplay=1
2015-01-29 18:03 - 2015-01-29 18:37 - 00014302 _____ () C:\Users\Jeanette\Documents\Sicherungskopie von Kassenbericht 2014.wbk
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 __SHD () C:\Users\Jeanette\AppData\Local\EmieUserList
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 __SHD () C:\Users\Jeanette\AppData\Local\EmieSiteList
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 __SHD () C:\Users\Jeanette\AppData\Local\EmieBrowserModeList
2015-01-24 13:07 - 2015-01-24 13:07 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\pcwJavaUpdate
2015-01-24 13:06 - 2015-01-24 13:06 - 00017787 _____ () C:\Users\Jeanette\Downloads\pcwJavaUpdater_103.zip
2015-01-21 15:40 - 2015-02-13 11:32 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-21 15:39 - 2015-01-21 15:39 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-21 15:39 - 2015-01-21 15:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-21 15:39 - 2015-01-21 15:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-21 15:39 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-01-21 15:39 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-01-21 15:39 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-01-21 15:35 - 2015-01-21 15:35 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Jeanette\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-20 16:47 - 2015-01-24 13:35 - 00000000 ____D () C:\windows\erdnt
2015-01-20 16:33 - 2015-01-24 13:41 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-20 16:32 - 2015-01-20 16:32 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jeanette\Downloads\revosetup95.exe
2015-01-16 17:38 - 2015-01-16 17:41 - 00000000 ____D () C:\Program Files\HWiNFO64
2015-01-16 17:38 - 2015-01-16 17:38 - 00026528 _____ (REALiX(tm)) C:\windows\system32\Drivers\HWiNFO64A.SYS
2015-01-16 17:38 - 2015-01-16 17:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HWiNFO64
2015-01-16 17:37 - 2015-01-16 17:37 - 02699320 _____ (Martin Malík - REALiX ) C:\Users\Jeanette\Downloads\hw64_448.exe
2015-01-16 12:15 - 2015-01-16 12:15 - 00380416 _____ () C:\Users\Jeanette\Downloads\Gmer-19357.exe
2015-01-16 11:52 - 2015-01-16 11:52 - 01353682 _____ () C:\Users\Jeanette\Downloads\hwmonitor_1.26.zip
2015-01-16 11:52 - 2015-01-16 11:52 - 00000000 ____D () C:\Users\Jeanette\Downloads\hwmonitor_1.26
2015-01-16 11:51 - 2015-01-16 18:04 - 00000000 ____D () C:\Users\Jeanette\Downloads\hwmonitor_1.24
2015-01-16 11:51 - 2015-01-16 11:51 - 01211573 _____ () C:\Users\Jeanette\Downloads\hwmonitor_1.24.zip
2015-01-16 11:44 - 2015-01-16 11:44 - 00141480 _____ () C:\Users\Jeanette\Downloads\bluescreenview_152setup.exe
2015-01-16 11:44 - 2015-01-16 11:44 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2015-01-16 11:44 - 2015-01-16 11:44 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2015-01-16 11:31 - 2015-01-16 11:31 - 00278144 _____ () C:\windows\Minidump\011615-38547-01.dmp
2015-01-16 06:42 - 2015-01-16 06:42 - 00278144 _____ () C:\windows\Minidump\011615-37627-01.dmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-15 08:51 - 2012-04-01 12:03 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-15 08:34 - 2011-05-17 16:16 - 01641273 _____ () C:\windows\WindowsUpdate.log
2015-02-14 20:48 - 2011-11-27 14:43 - 00000000 ____D () C:\Users\Jeanette\Documents\Outlook-Dateien
2015-02-14 17:30 - 2013-11-27 19:23 - 00000000 ____D () C:\Users\Jeanette\Documents\Citavi 4
2015-02-14 17:09 - 2009-07-14 05:45 - 00019296 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-14 17:09 - 2009-07-14 05:45 - 00019296 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-14 17:02 - 2013-12-09 16:03 - 00000000 ___RD () C:\Users\Jeanette\Dropbox
2015-02-14 17:01 - 2013-12-09 15:59 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Dropbox
2015-02-14 16:59 - 2014-12-29 11:51 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-02-14 16:59 - 2013-12-07 17:32 - 00038409 _____ () C:\windows\setupact.log
2015-02-14 16:59 - 2012-04-01 12:03 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-14 16:59 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-13 11:04 - 2011-06-12 21:33 - 00000000 ____D () C:\Users\Jeanette\vista alt
2015-02-13 10:42 - 2013-12-08 18:55 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-13 10:32 - 2014-02-27 18:24 - 418907904 _____ () C:\windows\MEMORY.DMP
2015-02-13 10:32 - 2011-09-18 14:01 - 00000000 ____D () C:\windows\Minidump
2015-02-12 21:37 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\rescache
2015-02-12 19:05 - 2012-07-07 08:41 - 01594964 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2015-02-12 19:05 - 2011-05-17 23:46 - 00699682 _____ () C:\windows\system32\perfh007.dat
2015-02-12 19:05 - 2011-05-17 23:46 - 00149790 _____ () C:\windows\system32\perfc007.dat
2015-02-12 19:05 - 2009-07-14 06:13 - 01594964 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-11 09:23 - 2011-06-05 09:16 - 00000000 ____D () C:\Users\Jeanette
2015-02-11 09:07 - 2013-12-08 15:22 - 01070476 _____ () C:\windows\PFRO.log
2015-02-11 08:56 - 2014-12-11 14:06 - 00000000 ____D () C:\windows\system32\appraiser
2015-02-11 08:56 - 2014-07-09 16:41 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-02-11 08:56 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\tracing
2015-02-11 08:54 - 2011-08-19 10:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-11 08:54 - 2009-07-14 03:34 - 00000478 _____ () C:\windows\win.ini
2015-02-11 08:11 - 2013-12-09 16:00 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-02-11 08:05 - 2009-07-14 05:45 - 00459784 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-10 22:24 - 2013-07-16 21:55 - 00000000 ____D () C:\windows\system32\MRT
2015-02-10 22:13 - 2011-06-08 20:03 - 116773704 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-02-10 22:06 - 2011-05-17 16:43 - 00000000 ____D () C:\ProgramData\Temp
2015-02-10 20:43 - 2013-12-20 13:12 - 00007603 _____ () C:\Users\Jeanette\AppData\Local\Resmon.ResmonCfg
2015-02-10 20:36 - 2011-06-06 11:20 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-08 18:09 - 2012-09-28 11:28 - 00000000 ____D () C:\ProgramData\Licenses
2015-02-07 16:57 - 2014-11-26 15:59 - 00001949 _____ () C:\Users\Public\Desktop\Citavi 4.lnk
2015-02-07 16:57 - 2013-11-27 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citavi 4
2015-02-07 16:57 - 2012-01-09 19:12 - 00000000 ____D () C:\ProgramData\Swiss Academic Software
2015-02-07 16:51 - 2011-09-10 11:23 - 00000000 ____D () C:\Users\Jeanette\AppData\Local\Downloaded Installations
2015-02-07 15:46 - 2012-04-01 12:03 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 15:46 - 2012-04-01 12:03 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-04 08:06 - 2009-07-14 06:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2015-02-04 08:05 - 2011-12-13 12:33 - 00001421 _____ () C:\Users\Finja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-28 17:12 - 2012-08-28 09:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 20:26 - 2011-06-06 09:53 - 00000000 ____D () C:\Program Files (x86)\Internet
2015-01-24 13:40 - 2013-12-14 13:02 - 00001616 _____ () C:\DelFix.txt
2015-01-24 13:09 - 2013-11-12 14:35 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-24 13:09 - 2013-11-12 14:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-20 17:24 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-01-20 17:13 - 2009-07-14 03:34 - 00000215 _____ () C:\windows\system.ini
2015-01-20 17:11 - 2009-07-14 03:34 - 97255424 _____ () C:\windows\system32\config\software.bak
2015-01-20 17:11 - 2009-07-14 03:34 - 24641536 _____ () C:\windows\system32\config\system.bak
2015-01-20 17:11 - 2009-07-14 03:34 - 00524288 _____ () C:\windows\system32\config\default.bak
2015-01-20 17:11 - 2009-07-14 03:34 - 00262144 _____ () C:\windows\system32\config\security.bak
2015-01-20 17:11 - 2009-07-14 03:34 - 00262144 _____ () C:\windows\system32\config\sam.bak
2015-01-20 17:08 - 2011-06-05 20:42 - 00000000 ____D () C:\Users\Christoph
2015-01-20 16:40 - 2011-10-30 19:23 - 00000000 ____D () C:\Users\Jeanette\AppData\Roaming\Winamp
2015-01-16 11:40 - 2011-06-15 09:44 - 00000000 ____D () C:\Users\Jeanette\Documents\Nähen
2015-01-16 11:34 - 2013-08-30 10:12 - 00000000 ____D () C:\Users\Public\Documents\PearlMountain
2015-01-16 11:34 - 2013-06-01 20:05 - 00000000 ____D () C:\Users\Jeanette\Documents\PassionFruit Games
2015-01-16 11:34 - 2011-08-22 09:22 - 00000000 ____D () C:\Users\Public\Documents\Kontoauszüge

==================== Files in the root of some directories =======

2013-12-18 14:28 - 2013-12-18 14:45 - 50063360 _____ () C:\Program Files (x86)\GUTD662.tmp
2011-10-06 08:42 - 2012-02-12 20:33 - 0007833 _____ () C:\Users\Jeanette\AppData\Roaming\ezplay.cat
2011-10-06 08:42 - 2012-02-12 20:33 - 0001127 _____ () C:\Users\Jeanette\AppData\Roaming\ezplay.inf
2011-10-06 08:42 - 2011-10-06 08:42 - 0000125 _____ () C:\Users\Jeanette\AppData\Roaming\ezplay.ini
2011-10-06 08:43 - 2012-02-12 20:33 - 0000033 _____ () C:\Users\Jeanette\AppData\Roaming\ezplay.log
2011-10-06 08:42 - 2012-02-12 20:33 - 0118400 _____ (VSO Software) C:\Users\Jeanette\AppData\Roaming\ezplay.sys
2011-10-06 08:42 - 2012-02-12 20:33 - 0099384 _____ () C:\Users\Jeanette\AppData\Roaming\inst.exe
2012-11-15 14:15 - 2012-11-15 14:15 - 0021887 _____ () C:\Users\Jeanette\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2012-01-02 15:47 - 2012-01-02 15:47 - 0004096 ____H () C:\Users\Jeanette\AppData\Local\keyfile3.drm
2013-11-08 14:22 - 2013-11-08 14:22 - 0005506 _____ () C:\Users\Jeanette\AppData\Local\recently-used.xbel
2013-12-20 13:12 - 2015-02-10 20:43 - 0007603 _____ () C:\Users\Jeanette\AppData\Local\Resmon.ResmonCfg
2011-10-05 14:26 - 2012-04-17 11:47 - 0000040 ___SH () C:\ProgramData\.zreglib
2011-06-05 13:29 - 2011-06-05 13:29 - 0000088 _____ () C:\ProgramData\profile.xml

Some content of TEMP:
====================
C:\Users\Christoph\AppData\Local\Temp\avgnt.exe
C:\Users\Finja\AppData\Local\Temp\avgnt.exe
C:\Users\Jeanette\AppData\Local\Temp\avgnt.exe
C:\Users\Jeanette\AppData\Local\Temp\DRHelper_uninstallComplete.exe
C:\Users\Jeanette\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpu2rnop.dll
C:\Users\Jeanette\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwk3ors.dll
C:\Users\Jeanette\AppData\Local\Temp\Quarantine.exe
C:\Users\Jeanette\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-13 12:39

==================== End Of Log ============================
         

--- --- ---


Alles wieder normal, glaube ich :-)

Vielen Dank, wie immer zuverlässig, kompetent und schnell.
Gruß Jeanette

Alte Java Versionen deinstallieren.

Fertig

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hallo,

veraltetes Java deinstalliert und alles wie du es beschriebst durchgeführt. Dann TFC runtergeladen, instaliert und ausgeführt. Kurz danach stürzte der Rechner wieder ab. Mit folgendem Bluescreen:

==================================================
Dump File         : 021615-94505-01.dmp
Crash Time        : 16.02.2015 15:43:08
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a0`08000000
Parameter 2       : 00000000`00000000
Parameter 3       : fffff880`02e0bc02
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+74ec0
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Processor         : x64
Crash Address     : ntoskrnl.exe+74ec0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\windows\Minidump\021615-94505-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 278.144
Dump File Time    : 16.02.2015 15:46:35
==================================================
         

Wenn wir davon ausgehen, dass der Rechner sauber ist, was wäre dann ein möglicher Grund für die Abstürze? Oder woran kann es liegen?

Gruß,
ennachen

Ich denke dieser Absturz lag an TFC, das passiert schon mal.

Dann kann ich nur :"DANKE" sagen und ich denke, es ist alles erledigt.

Viele Grüße,

Ennachen

Gern Geschehen